VYPR
← All advisories
Medium severity4.3NVD Advisory· Published May 13, 2026· Updated May 18, 2026

CVE-2026-8202

CVE-2026-8202

Description

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.

This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • MongoDB/MongoDB2 versions
    cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: >=7.0.0,<7.0.34
    • (no CPE)range: >=7.0, <7.0.34; >=8.0, <8.0.23; >=8.2, <8.2.9; >=8.3, <8.3.2
  • osv-coords
    pkg:bitnami/mongodb
    Range: >= 7.0.0, < 7.0.34

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.