Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution

Why this deserves its current priority

CVSS is 6.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps MongoDB/MongoDB Server (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for MongoDB/MongoDB Server.
2. 2Review the reported fix. Update MongoDB/MongoDB Server to 8.3.8 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 11, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 16, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 11, 2026

Sources and claim methodology

• Source referencejira.mongodb.org

Related CVEs

• Various packet overreads in mysqlnd_writeprotocol.cSame generic ecosystem
• Integer overflow to buffer overflow in soap HTTP parsingSame generic ecosystem
• TDuck survey form through 6.0 Missing Authorization in Form Theme Management EndpointsSame generic ecosystem
• TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership CheckSame generic ecosystem
• TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission EndpointSame generic ecosystem
• TDuck survey form through 6.0 Write Password Bypass via Client-Side EnforcementSame generic ecosystem