Skip to content
OpenAdvisories
High · 7.1 CVE-2026-18687 EUVD-2026-56864GHSA-q4pc-c9m4-c873

Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption

Published Aug 11, 2026 · Updated Aug 11, 2026 · Assigned by mongodb

Description

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 8.3.0 – < 8.3.8, 8.0 – < 8.0.29 8.3.8

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS mongodb No fix yet —
Ubuntu Pro 18.04 LTS mongodb No fix yet —
Ubuntu Pro 16.04 LTS mongodb No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS mongodb No fix yet —

Advisories 1

References