CVE-2026-8843
- Source
- https://cve.org/CVERecord?id=CVE-2026-8843
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8843.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-8843
- Aliases
- Downstream
UBUNTU (1)
- Published
- 2026-05-18T15:40:06Z
- Modified
- 2026-09-26T08:10:31Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Calling createIndex with certain index types can crash mongod
- Details
-
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices.
This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
- Database specific
{ "cna_assigner": "mongodb", "cwe_ids": [ "CWE-617" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8843.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "7.0" }, { "fixed": "7.0.32" }, { "introduced": "8.0" }, { "fixed": "8.0.21" }, { "introduced": "8.2" }, { "fixed": "8.2.6" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/mongodb/mongo
Affected ranges
- Type
- GIT
- Repo
- https://github.com/mongodb/mongo
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "7.0.0" }, { "fixed": "7.0.32" }, { "introduced": "8.0.0" }, { "fixed": "8.0.21" }, { "introduced": "8.2.0" }, { "fixed": "8.2.6" } ], "source": "CPE_RANGE" }
Affected versions
r7.*
r7.0.0
r7.0.1
r7.0.1-rc0
r7.0.10
r7.0.10-rc0
r7.0.11
r7.0.11-rc0
r7.0.11-rc1
r7.0.11-rc2
r7.0.12
r7.0.12-rc0
r7.0.12-rc1
r7.0.13
r7.0.13-rc0
r7.0.13-rc1
r7.0.14
r7.0.14-rc0
r7.0.15
r7.0.15-rc0
r7.0.15-rc1
r7.0.16
r7.0.16-rc0
r7.0.16-rc1
r7.0.17
r7.0.18
r7.0.2
r7.0.2-rc0
r7.0.2-rc1
r7.0.2-rc2
r7.0.21
r7.0.21-alpha0
r7.0.21-rc0
r7.0.22
r7.0.22-rc0
r7.0.23
r7.0.23-rc0
r7.0.23-rc1
r7.0.24
r7.0.24-rc0
r7.0.25-alpha0
r7.0.26
r7.0.26-rc0
r7.0.27
r7.0.27-alpha0
r7.0.27-rc0
r7.0.3
r7.0.3-rc0
r7.0.3-rc1
r7.0.4
r7.0.4-rc0
r7.0.5
r7.0.5-rc0
r7.0.6
r7.0.6-rc0
r7.0.7
r7.0.7-rc0
r7.0.7-rc1
r7.0.7-rc2
r7.0.8
r7.0.8-rc0
r7.0.9
r7.0.9-rc0
r7.0.9-rc1
r8.*
r8.0.0
r8.0.1
r8.0.1-rc0
r8.0.10
r8.0.10-rc0
r8.0.12
r8.0.12-rc0
r8.0.13
r8.0.13-rc0
r8.0.13-rc1
r8.0.13-rc2
r8.0.14
r8.0.14-rc0
r8.0.14-rc1
r8.0.16
r8.0.16-rc0
r8.0.16-rc1
r8.0.17-alpha0
r8.0.2
r8.0.3
r8.0.4
r8.0.4-rc0
r8.0.5
r8.0.5-rc0
r8.0.5-rc1
r8.0.5-rc2
r8.0.6
r8.2.0
r8.2.1
r8.2.1-rc0
r8.2.1-rc1
r8.2.2
r8.2.2-rc0
r8.2.3-alpha0
r8.2.4-alpha0
r8.2.4-alpha1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8843.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"212916051933611333336019566765871154533",
"127072531193682496647404363037825275968",
"82618083542634382065142722552922596523",
"4324924340243736427572372707787432252"
],
"threshold": 0.9
},
"id": "CVE-2026-8843-074a18d5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/32a732a9b646200050bedd569d0e18fda534f92c",
"target": {
"file": "src/mongo/util/md5.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "164686043380698660719722351152006285402",
"length": 2908
},
"id": "CVE-2026-8843-3ef5e661",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/08e0c4612b855c4e73385c2ec838588f82d8a19b",
"target": {
"file": "src/mongo/db/mongod_main.cpp",
"function": "mongod_main"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"179215270457449443453579291868469199727",
"33556446067133974934969847839402282197",
"29350364556964231604783587715398600263",
"57726341186909301783117793920654563686",
"136845089925583489291724266187596164684",
"305634184878952065582817930778120911044",
"172837088109626467133187672572056083021"
],
"threshold": 0.9
},
"id": "CVE-2026-8843-4f010fbc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/08e0c4612b855c4e73385c2ec838588f82d8a19b",
"target": {
"file": "src/mongo/db/mongod_main.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"113943198681305830374459943796736910273",
"284155681462991298677336326783867736476",
"322305722881740005680917803045236736977",
"91774852827086589335342822882248207662",
"229647983256621488789011376734284527782",
"281813804611164678198537084954231215930",
"244936745804740692166401377847527106794"
],
"threshold": 0.9
},
"id": "CVE-2026-8843-74d68245",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/08e0c4612b855c4e73385c2ec838588f82d8a19b",
"target": {
"file": "src/mongo/s/mongos_main.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "79148053720149972531027689719546447436",
"length": 2005
},
"id": "CVE-2026-8843-8f2fa9a0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/08e0c4612b855c4e73385c2ec838588f82d8a19b",
"target": {
"file": "src/mongo/s/mongos_main.cpp",
"function": "mongos_main"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "253896680426164393151009864932457722232",
"length": 57
},
"id": "CVE-2026-8843-de078695",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/mongodb/mongo/commit/32a732a9b646200050bedd569d0e18fda534f92c",
"target": {
"file": "src/mongo/util/md5.cpp",
"function": "md5_init_state"
}
}
]
vanir_signatures_modified
"2026-09-26T08:10:31Z"