Loading vulnerability…
Authenticated Memory-Exhaustion Denial of Service in MongoDB Server Aggregation
CVE-2026-120810 is an unrestricted resource-allocation vulnerability in MongoDB Server's aggregation framework. An internal expression is registered as accessible to authenticated clients and performs unbounded memory allocations without enforcing per-expression memory limits. An authenticated user with read privileges can submit specially crafted aggregate commands across multiple concurrent connections to exhaust server memory, potentially causing the operating system's out-of-memory killer to terminate the mongod process. Affected versions are 7.0.0 through versions before 7.0.48, 8.0.0 through versions before 8.0.37, 8.3.0 through versions before 8.3.16, and 9.0.0 through versions before 9.0.7.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust available server memory and cause termination of the mongod process, interrupting database availability for applications and users dependent on the affected instance.
Patch, then assume compromise.
Upgrade MongoDB Server to version 7.0.48, 8.0.37, 8.3.16, or 9.0.7, or a later release in the corresponding branch.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.