CVE-2026-18700: mongodb from 7.0.0 (inclusive), before 7.0.40 (exclusive), from 8.0.0 (inclusive), before 8.0.29 (exclusive), from…

Affected technology

mongodb · from 7.0.0 (inclusive), before 7.0.40 (exclusive)
mongodb

mongodb · from 8.0.0 (inclusive), before 8.0.29 (exclusive)
mongodb

mongodb · from 8.2.0 (inclusive), through 8.2.12 (inclusive)
mongodb

mongodb · from 8.3.0 (inclusive), before 8.3.8 (exclusive)
mongodb

mongodb · 9.0.0 · update alpha0
mongodb

mongodb · 9.0.0 · update alpha1
mongodb

mongodb · 9.1.0 · update alpha0
mongodb

MongoDB Server · 8.3.0 to before 8.3.8, 8.0 to before 8.0.29, 7.0 to before 7.0.40
MongoDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with write privileges to cause an internal reference could be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. Vendor/CNA’s CVSS 4.0 assessment (base score 6.0/10) rates confidentiality and integrity impact as none; availability impact as high.