Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps MongoDB/MongoDB Server (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for MongoDB/MongoDB Server.
2. 2Review the reported fix. Update MongoDB/MongoDB Server to 8.3.9 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 8, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 8, 2026

Sources and claim methodology

• Source referencejira.mongodb.org

Related CVEs

• $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 charsSame mongodb/mongodb server package
• Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role AssignmentSame mongodb/mongodb server package
• Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of ServiceSame mongodb/mongodb server package
• Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of ServiceSame mongodb/mongodb server package
• Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of ServiceSame mongodb/mongodb server package
• Type Confusion in MongoDB Server WiredTiger Storage Engine via Custom Collection Configuration Leads to Persistent Denial of ServiceSame mongodb/mongodb server package