Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure

Why this deserves its current priority

CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps MongoDB/MongoDB Server (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for MongoDB/MongoDB Server.
2. 2Review the reported fix. Update MongoDB/MongoDB Server to 8.3.8 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 11, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 16, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 11, 2026

Sources and claim methodology

• Source referencejira.mongodb.org

Related CVEs

• pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserializationAlso CWE-125
• OOB read / info leak in convert.* stream filters when line-break-chars contains NULAlso CWE-125
• Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerAlso CWE-125
• Various packet overreads in mysqlnd_writeprotocol.cSame generic ecosystem
• Integer overflow to buffer overflow in soap HTTP parsingSame generic ecosystem
• TDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsSame generic ecosystem