CVE-2026-82054

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

Database specific

{
    "cna_assigner": "mongodb",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82054.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.3.0"
                },
                {
                    "fixed": "8.3.9"
                },
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.0.30"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.0.41"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type

GIT

Repo

https://github.com/mongodb/mongo

Events

Introduced

37d84072b5c5b9fd723db5fa133fb202ad2317f1

Fixed

6df23543fc9e7ee456ff05ed726b22865ea753e7

Introduced

b41cda4fe697dce6fd9b83b3805362ccc02fbeb3

Fixed

11c3ed7c274d5fb7149e498323bd0377c3a2876e

Introduced

b993867dce63dd366cd93e60f3f425ed716f6497

Last Affected

10d50f5046de5c76a9d869823219134b3596905a

Introduced

0f29b043a58fdd251ce0a0b32754b8459613c933

Fixed

1dc3d60c3237b53589325474c668e849ecec3bae

Introduced

3a33d18cd99f6855f658572fadf4f17ca699a9fe

Last Affected

e78de88ae7504aee707fd083c579c3f54eab50ab

Database specific

Show details

{
    "cpe": [
        "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*",
        "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*",
        "cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.41"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.30"
        },
        {
            "introduced": "8.2.0"
        },
        {
            "last_affected": "8.2.12"
        },
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.3.9"
        },
        {
            "introduced": "9.0.0-alpha0"
        },
        {
            "last_affected": "9.0.0-alpha0"
        },
        {
            "introduced": "9.0.0-alpha1"
        },
        {
            "last_affected": "9.0.0-alpha1"
        },
        {
            "introduced": "9.1.0-alpha0"
        },
        {
            "last_affected": "9.1.0-alpha0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

9.*

9.0.0-alpha0

9.0.0-alpha1

9.1.0-alpha0

r7.*

r7.0.0

r7.0.1

r7.0.1-rc0

r7.0.10

r7.0.10-rc0

r7.0.11

r7.0.11-rc0

r7.0.11-rc1

r7.0.11-rc2

r7.0.12

r7.0.12-rc0

r7.0.12-rc1

r7.0.13

r7.0.13-rc0

r7.0.13-rc1

r7.0.14

r7.0.14-rc0

r7.0.15

r7.0.15-rc0

r7.0.15-rc1

r7.0.16

r7.0.16-rc0

r7.0.16-rc1

r7.0.17

r7.0.18

r7.0.2

r7.0.2-rc0

r7.0.2-rc1

r7.0.2-rc2

r7.0.21

r7.0.21-alpha0

r7.0.21-rc0

r7.0.22

r7.0.22-rc0

r7.0.23

r7.0.23-rc0

r7.0.23-rc1

r7.0.24

r7.0.24-rc0

r7.0.25-alpha0

r7.0.26

r7.0.26-rc0

r7.0.27

r7.0.27-alpha0

r7.0.27-rc0

r7.0.3

r7.0.3-rc0

r7.0.3-rc1

r7.0.35

r7.0.4

r7.0.4-rc0

r7.0.5

r7.0.5-rc0

r7.0.6

r7.0.6-rc0

r7.0.7

r7.0.7-rc0

r7.0.7-rc1

r7.0.7-rc2

r7.0.8

r7.0.8-rc0

r7.0.9

r7.0.9-rc0

r7.0.9-rc1

r8.*

r8.0.0

r8.0.1

r8.0.1-rc0

r8.0.10

r8.0.10-rc0

r8.0.12

r8.0.12-rc0

r8.0.13

r8.0.13-rc0

r8.0.13-rc1

r8.0.13-rc2

r8.0.14

r8.0.14-rc0

r8.0.14-rc1

r8.0.16

r8.0.16-rc0

r8.0.16-rc1

r8.0.17-alpha0

r8.0.2

r8.0.24

r8.0.3

r8.0.4

r8.0.4-rc0

r8.0.5

r8.0.5-rc0

r8.0.5-rc1

r8.0.5-rc2

r8.0.6

r8.2.0

r8.2.1

r8.2.1-rc0

r8.2.1-rc1

r8.2.10

r8.2.12

r8.2.2

r8.2.2-rc0

r8.2.3-alpha0

r8.2.4-alpha0

r8.2.4-alpha1

r8.3.0

r8.3.3

r9.*

r9.0.0-alpha0

r9.0.0-alpha1

r9.1.0-alpha0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82054.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "66908565863182878949263117251652046873",
                "81045179624099588995371526936867447218",
                "40887363166120728720864979839570738440",
                "256732394880312722171336173841003327192",
                "189479856184880563329078480903896694545",
                "175148206283301428432002867622286913085",
                "305665546638865113923099657246304323513"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82054-7518edcc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/11c3ed7c274d5fb7149e498323bd0377c3a2876e",
        "target": {
            "file": "src/mongo/util/observable_mutex_registry.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "97328004591881352222915931748724594831",
            "length": 772
        },
        "id": "CVE-2026-82054-77577a26",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/6df23543fc9e7ee456ff05ed726b22865ea753e7",
        "target": {
            "file": "src/mongo/db/pipeline/document_source_list_catalog.cpp",
            "function": "DocumentSourceListCatalog::createFromBson"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "165410231648936824589980198196954162537",
                "136501663843339022690751043996234207290",
                "285354211900527027711069075030245862327",
                "118881528740665335694743800161340085998",
                "36266064472550105418329813861525007356",
                "16931947150780577515020757191522828473"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82054-ba1994eb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/6df23543fc9e7ee456ff05ed726b22865ea753e7",
        "target": {
            "file": "src/mongo/db/pipeline/document_source_list_catalog.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "15118513725026685067664956440423785894",
                "4881464334735159279508803095757659276",
                "266758334235923098891166228361922998690",
                "287039910505335082692569496912566155170",
                "215343628858689419312915919625353446408",
                "80950900741330922061414046051663341667",
                "48699755411854371597904640594615452680",
                "299434378678909034395123214857676742507",
                "320443038501231526517453934170620795671",
                "37185450870766536639064978090208934675",
                "330071214781083562802997609052830790317",
                "112905490564973162584994830096370086935"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82054-c539edfe",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/6df23543fc9e7ee456ff05ed726b22865ea753e7",
        "target": {
            "file": "src/mongo/db/pipeline/document_source_list_catalog.cpp"
        }
    }
]

vanir_signatures_modified

"2026-09-18T08:11:06Z"