VYPR
← All advisories
Medium severity6.5NVD Advisory· Published May 13, 2026· Updated May 13, 2026

CVE-2026-8199

CVE-2026-8199

Description

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • MongoDB/MongoDB2 versions
    cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: >=7.0.0,<7.0.34
    • (no CPE)range: <7.0.34, <8.0.23, <8.2.9, <8.3.2
  • osv-coords
    pkg:bitnami/mongodb
    Range: >= 7.0.0, < 7.0.34

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.