CVE-2026-89099 json
Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption
published 2026-09-11 58 d ago modified 2026-10-01 38 d ago also BIT-mongodb-2026-89099 , EUVD-2026-76165
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.
Patch / fix
- bitnami mongodb 7.0.43, 8.0.32, 8.3.11, 9.0.2
- MongoDB MongoDB Server 7.0.43, 8.0.32, 8.3.11
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 58 d ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mongodb | >=7.0.0, <7.0.43 >=8.0.0, <8.0.32 >=8.3.0, <8.3.11 >=9.0.0, <9.0.2 |
7.0.43 8.0.32 8.3.11 9.0.2 |
Affected products
- MongoDB MongoDB Server
Classification
- Weakness
-
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
- Technology feeds
References
-
jira.mongodb.org
/browse/SERVER-134063
vendor-advisory, issue-tracking, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-89099
web
Sources
- CVE List CVE-2026-89099
- NVD CVE-2026-89099
- OSV BIT-mongodb-2026-89099
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.