CVE-2026-82055 json
Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service
published 2026-09-08 2 mo ago modified 2026-09-17 52 d ago also BIT-mongodb-2026-82055 , EUVD-2026-72942
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.
Patch / fix
- bitnami mongodb 8.3.9
- MongoDB MongoDB Server 8.3.9
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | mongodb | >=8.3.0, <8.3.9 |
8.3.9 |
Affected products
- MongoDB MongoDB Server
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
- Technology feeds
References
-
jira.mongodb.org
/browse/SERVER-130202
vendor-advisory, issue-tracking, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-82055
web
Sources
- CVE List CVE-2026-82055
- NVD CVE-2026-82055
- OSV BIT-mongodb-2026-82055
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.