CVE-2026-8199: MongoDB DoS Vulnerability via Bitwise Match

CVE-2026-8199 Overview

CVE-2026-8199 is a denial of service vulnerability in MongoDB Server caused by inefficient memory usage during abstract syntax tree (AST) processing of bitwise match expressions. An authenticated user can craft queries using $bitsAllSet, $bitsAnySet, $bitsAllClear, or $bitsAnyClear operators that consume excessive memory. The resulting memory pressure can lead to out-of-memory (OOM) conditions and availability loss for the affected database instance. The flaw is tracked under CWE-1325: Improperly Controlled Sequential Memory Allocation and affects multiple supported release branches of MongoDB Server.

Critical Impact
Authenticated attackers can trigger out-of-memory conditions on MongoDB Server instances, degrading availability for all database consumers.

Affected Products

MongoDB Server v7.0 versions prior to 7.0.34
MongoDB Server v8.0 versions prior to 8.0.23
MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2

Discovery Timeline

2026-05-13 - CVE CVE-2026-8199 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8199

Vulnerability Analysis

The vulnerability resides in the query parser and AST builder that handles MongoDB bitwise match operators. When the server parses $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear predicates, it allocates memory proportional to attacker-influenced inputs without adequate bounds. Repeated or large bitwise expressions inflate the in-memory AST representation beyond expected sizes. The excess allocation pressures the working set of mongod, competing with legitimate workloads for system memory. Sustained exploitation can trigger the Linux OOM killer or process termination, taking the database offline.

Root Cause

The root cause is improperly controlled sequential memory allocation [CWE-1325] during match expression parsing. The bitwise operator handlers do not impose effective ceilings on the memory consumed when constructing the parsed AST for these predicates. Without bounded allocation, an authenticated client can amplify resource usage on the server by repeatedly issuing large bitwise predicates.

Attack Vector

The attack vector is network-based and requires valid authentication with permission to issue find or aggregation queries against the database. An attacker submits queries containing crafted bitwise match expressions to exhaust server memory. No user interaction is needed beyond the authenticated session. The vulnerability does not impact confidentiality or integrity but produces a high availability impact through memory exhaustion.

No public proof-of-concept code is available. See the MongoDB Server Issue Tracker (SERVER-122449) for vendor-provided technical details.

Detection Methods for CVE-2026-8199

Indicators of Compromise

Sudden spikes in mongod resident set size (RSS) without a corresponding increase in dataset or connection counts.
Repeated client queries containing $bitsAllSet, $bitsAnySet, $bitsAllClear, or $bitsAnyClear from a single authenticated user.
MongoDB process termination by the kernel OOM killer recorded in dmesg or system logs.

Detection Strategies

Enable MongoDB profiling and audit logs to capture queries containing the four affected bitwise operators and review for abnormal frequency or size.
Correlate slow query logs with host-level memory metrics to surface bitwise predicates that precede memory spikes.
Alert on authenticated principals whose query patterns deviate from historical baselines for operator usage.

Monitoring Recommendations

Track mem.resident, mem.virtual, and tcmalloc metrics exposed by serverStatus() for anomalous growth.
Forward MongoDB audit and diagnostic logs to a centralized SIEM for retention and query analytics across the fleet.
Configure alerts for repeated process restarts of mongod and for OOM events on database hosts.

How to Mitigate CVE-2026-8199

Immediate Actions Required

Upgrade MongoDB Server to a fixed release: 7.0.34, 8.0.23, 8.2.9, or 8.3.2 or later.
Audit user roles and revoke query privileges from accounts that do not require read access.
Apply per-user query governance to limit the rate and size of submitted predicates.

Patch Information

MongoDB has issued patched releases that resolve the excessive memory allocation in bitwise match expression AST processing. Upgrade to MongoDB Server 7.0.34, 8.0.23, 8.2.9, 8.3.2, or later. Refer to the MongoDB Server Issue Tracker (SERVER-122449) for release notes and fix details.

Workarounds

Restrict use of the $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear operators through application-layer query validation until patching is complete.
Enforce role-based access control so only trusted service accounts can execute ad hoc queries against production clusters.
Configure cgroup memory limits and mongod resource quotas to contain the blast radius of an OOM event on shared hosts.

bash

# Configuration example: verify installed MongoDB version and upgrade target
mongod --version

# Example role hardening: grant read only where required
mongosh <<'EOF'
use admin
db.revokeRolesFromUser("reporting_user", [ { role: "readWrite", db: "prod" } ])
db.grantRolesToUser("reporting_user", [ { role: "read", db: "prod" } ])
EOF