CVE-2026-8201

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-8201
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8201.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-8201
Aliases
Downstream
Published
2026-05-13T00:12:35.299Z
Modified
2026-07-22T00:06:01.574409Z
Severity
  • 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N CVSS Calculator
Summary
Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields
Details

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query.

This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Database specific 
{
    "cna_assigner": "mongodb",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8201.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.0.34"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.0.23"
                },
                {
                    "introduced": "8.2"
                },
                {
                    "fixed": "8.2.9"
                },
                {
                    "introduced": "8.3"
                },
                {
                    "fixed": "8.3.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-416"
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo
Events
Introduced
37d84072b5c5b9fd723db5fa133fb202ad2317f1
Fixed
c4112034073d61ecdfc209fb769c6b08102af643
Introduced
b41cda4fe697dce6fd9b83b3805362ccc02fbeb3
Fixed
e1c5eb1c5d29781674274ced38871c117967302e
Introduced
b993867dce63dd366cd93e60f3f425ed716f6497
Fixed
551096db8ad4a951af553de51c5485d5fd91d40d
Introduced
0f29b043a58fdd251ce0a0b32754b8459613c933
Fixed
c531abff36f228c5ff24735ddf31a23536716ab0
Database specific 
{
    "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.34"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.23"
        },
        {
            "introduced": "8.2.0"
        },
        {
            "fixed": "8.2.9"
        },
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.3.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

r7.*
r7.0.0
r7.0.1
r7.0.1-rc0
r7.0.10
r7.0.10-rc0
r7.0.11
r7.0.11-rc0
r7.0.11-rc1
r7.0.11-rc2
r7.0.12
r7.0.12-rc0
r7.0.12-rc1
r7.0.13
r7.0.13-rc0
r7.0.13-rc1
r7.0.14
r7.0.14-rc0
r7.0.15
r7.0.15-rc0
r7.0.15-rc1
r7.0.16
r7.0.16-rc0
r7.0.16-rc1
r7.0.17
r7.0.18
r7.0.2
r7.0.2-rc0
r7.0.2-rc1
r7.0.2-rc2
r7.0.21
r7.0.21-alpha0
r7.0.21-rc0
r7.0.22
r7.0.22-rc0
r7.0.23
r7.0.23-rc0
r7.0.23-rc1
r7.0.24
r7.0.24-rc0
r7.0.25-alpha0
r7.0.26
r7.0.26-rc0
r7.0.27
r7.0.27-alpha0
r7.0.27-rc0
r7.0.3
r7.0.3-rc0
r7.0.3-rc1
r7.0.4
r7.0.4-rc0
r7.0.5
r7.0.5-rc0
r7.0.6
r7.0.6-rc0
r7.0.7
r7.0.7-rc0
r7.0.7-rc1
r7.0.7-rc2
r7.0.8
r7.0.8-rc0
r7.0.9
r7.0.9-rc0
r7.0.9-rc1
r8.*
r8.0.0
r8.0.1
r8.0.1-rc0
r8.0.10
r8.0.10-rc0
r8.0.12
r8.0.12-rc0
r8.0.13
r8.0.13-rc0
r8.0.13-rc1
r8.0.13-rc2
r8.0.14
r8.0.14-rc0
r8.0.14-rc1
r8.0.16
r8.0.16-rc0
r8.0.16-rc1
r8.0.17-alpha0
r8.0.2
r8.0.3
r8.0.4
r8.0.4-rc0
r8.0.5
r8.0.5-rc0
r8.0.5-rc1
r8.0.5-rc2
r8.0.6
r8.2.0
r8.2.1
r8.2.1-rc0
r8.2.1-rc1
r8.2.2
r8.2.2-rc0
r8.2.3-alpha0
r8.2.4-alpha0
r8.2.4-alpha1
r8.3.0
r8.3.1

Database specific

vanir_signatures_modified 
"2026-07-22T00:06:01Z"
vanir_signatures 
[
    {
        "target": {
            "function": "Obj::search",
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-08ad15c4",
        "digest": {
            "function_hash": "17181056965332531028681155129851284942",
            "length": 988.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/c531abff36f228c5ff24735ddf31a23536716ab0"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map.cpp"
        },
        "id": "CVE-2026-8201-0d4e9a65",
        "digest": {
            "line_hashes": [
                "177361865065735962293648793371738015520",
                "56663648429656493573312763376701299105",
                "184179022178081026556663717830952869204",
                "338093175566202092831974358750630828801"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/e1c5eb1c5d29781674274ced38871c117967302e"
    },
    {
        "target": {
            "function": "Obj::search",
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-1233fa22",
        "digest": {
            "function_hash": "248754881996670566875919044360329754468",
            "length": 965.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/e1c5eb1c5d29781674274ced38871c117967302e"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-3797dc56",
        "digest": {
            "line_hashes": [
                "65317806234226920521720845331578521082",
                "245205739251347437876425597495755876481",
                "109749818435937265218130737097210075244",
                "247724741587646782412887786320692163933",
                "328299337808136919563643867456051799671",
                "168020673177810988486900283615589649830",
                "170052273858241919648121125823866015059",
                "177147919177640274616929074969145590120",
                "140861398997613641900615087528359816369",
                "294172095836668649572112064188327133592",
                "103431700251158212873865689548307615353",
                "21787099695343064233815986318428483963",
                "157562864901160561707888628653518219141",
                "250504151046058816035709411326397744704"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/c531abff36f228c5ff24735ddf31a23536716ab0"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map.cpp"
        },
        "id": "CVE-2026-8201-3d904649",
        "digest": {
            "line_hashes": [
                "292572099948037041716578539154433823516",
                "168860491958264251483141325059901754282",
                "304117868208266248508117415656816929694",
                "179593579132299061605021834936400112936"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/551096db8ad4a951af553de51c5485d5fd91d40d"
    },
    {
        "target": {
            "function": "Obj::insert",
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-46a07206",
        "digest": {
            "function_hash": "70226459102367042737321538611145560590",
            "length": 1050.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/c531abff36f228c5ff24735ddf31a23536716ab0"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/minmax_test.cpp"
        },
        "id": "CVE-2026-8201-55c6a28a",
        "digest": {
            "line_hashes": [
                "291363120804310266702293571491914596809",
                "33869876076183871238703932409763090783"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/c531abff36f228c5ff24735ddf31a23536716ab0"
    },
    {
        "target": {
            "function": "MeasurementMap::insertOne",
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map.cpp"
        },
        "id": "CVE-2026-8201-573b1c19",
        "digest": {
            "function_hash": "43553138671068495841916643857804982519",
            "length": 579.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/c531abff36f228c5ff24735ddf31a23536716ab0"
    },
    {
        "target": {
            "function": "MeasurementMap::insertOne",
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map.cpp"
        },
        "id": "CVE-2026-8201-75a9fb4a",
        "digest": {
            "function_hash": "235186305860120437080630099775444005722",
            "length": 614.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/e1c5eb1c5d29781674274ced38871c117967302e"
    },
    {
        "target": {
            "function": "MeasurementMap::insertOne",
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map.cpp"
        },
        "id": "CVE-2026-8201-7b34e191",
        "digest": {
            "function_hash": "284460113755408055723012211659961360780",
            "length": 599.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/551096db8ad4a951af553de51c5485d5fd91d40d"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-909e5027",
        "digest": {
            "line_hashes": [
                "65317806234226920521720845331578521082",
                "77418424018421380114686688518704574493",
                "317515015368777078225808890688114070562",
                "326214854906577967442080595487639946461",
                "170564889008869462625644256705907275570",
                "168020673177810988486900283615589649830",
                "170052273858241919648121125823866015059",
                "176654919317878522102121072790071726106",
                "90432907306522700838350746473018895443",
                "126293671504703890019011171480361691948",
                "252259150684507875211888142394588007716",
                "21787099695343064233815986318428483963",
                "157562864901160561707888628653518219141",
                "250504151046058816035709411326397744704"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/e1c5eb1c5d29781674274ced38871c117967302e"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/minmax_test.cpp"
        },
        "id": "CVE-2026-8201-99c363df",
        "digest": {
            "line_hashes": [
                "291363120804310266702293571491914596809",
                "33869876076183871238703932409763090783"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/e1c5eb1c5d29781674274ced38871c117967302e"
    },
    {
        "target": {
            "function": "Obj::insert",
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-99c94ad3",
        "digest": {
            "function_hash": "41793835850554501932203498494697985687",
            "length": 1051.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/e1c5eb1c5d29781674274ced38871c117967302e"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-a00600ff",
        "digest": {
            "line_hashes": [
                "65317806234226920521720845331578521082",
                "245205739251347437876425597495755876481",
                "109749818435937265218130737097210075244",
                "247724741587646782412887786320692163933",
                "328299337808136919563643867456051799671",
                "168020673177810988486900283615589649830",
                "170052273858241919648121125823866015059",
                "177147919177640274616929074969145590120",
                "140861398997613641900615087528359816369",
                "294172095836668649572112064188327133592",
                "103431700251158212873865689548307615353",
                "21787099695343064233815986318428483963",
                "157562864901160561707888628653518219141",
                "250504151046058816035709411326397744704"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/551096db8ad4a951af553de51c5485d5fd91d40d"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map_test.cpp"
        },
        "id": "CVE-2026-8201-ac57b75a",
        "digest": {
            "line_hashes": [
                "220012559814535802246991203699235448665",
                "292813745953450357917782590991431684195",
                "151782744504930929400284312418396007787"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/c531abff36f228c5ff24735ddf31a23536716ab0"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/minmax_test.cpp"
        },
        "id": "CVE-2026-8201-ae8682c1",
        "digest": {
            "line_hashes": [
                "291363120804310266702293571491914596809",
                "33869876076183871238703932409763090783"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/551096db8ad4a951af553de51c5485d5fd91d40d"
    },
    {
        "target": {
            "function": "Obj::search",
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-b20f3e14",
        "digest": {
            "function_hash": "17181056965332531028681155129851284942",
            "length": 988.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/551096db8ad4a951af553de51c5485d5fd91d40d"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map_test.cpp"
        },
        "id": "CVE-2026-8201-b7e9811b",
        "digest": {
            "line_hashes": [
                "113590516626605239294940485100571288810",
                "200762295114800290845951546202029883764",
                "268316385711008539282353089121521072588",
                "184940241524942480541267925278565633866",
                "57908861127480025164680135191487105877",
                "22008568524960951903435505329165604572",
                "283531283680862789255620472702442978052"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/551096db8ad4a951af553de51c5485d5fd91d40d"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map.cpp"
        },
        "id": "CVE-2026-8201-ca202f9e",
        "digest": {
            "line_hashes": [
                "189988079331693010828710016868224288344",
                "156644622417418443415807260198870532652",
                "127287703221177560262489158943077347278",
                "238171269685132529499568082580439161603",
                "5099464907976194915440695461937409677",
                "12579336589641520520804530894688239105",
                "9615073687642051710079005079633121505",
                "128352877459597030677197941825486183445",
                "73863290553960507209707682947063567550",
                "191257911512827898256694559820641371502",
                "127277178768055444847121840322197792737"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/c531abff36f228c5ff24735ddf31a23536716ab0"
    },
    {
        "target": {
            "function": "Obj::insert",
            "file": "src/mongo/db/timeseries/bucket_catalog/flat_bson.cpp"
        },
        "id": "CVE-2026-8201-dd5b676f",
        "digest": {
            "function_hash": "221304163357851772164061278326293544638",
            "length": 1066.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/mongodb/mongo/commit/551096db8ad4a951af553de51c5485d5fd91d40d"
    },
    {
        "target": {
            "file": "src/mongo/db/timeseries/bucket_catalog/measurement_map_test.cpp"
        },
        "id": "CVE-2026-8201-f17ae54c",
        "digest": {
            "line_hashes": [
                "57908861127480025164680135191487105877",
                "294900069628020547946929005649193023516",
                "229520935428280588577774129365411870335"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/mongodb/mongo/commit/e1c5eb1c5d29781674274ced38871c117967302e"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8201.json"