{"id":"CVE-2026-8199","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-8199","generatedAt":"2026-10-28T01:42:47.487Z","title":"An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear.","description":"An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM.\n\nThis issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.","published":"2026-05-13T04:17:42.000Z","lastModified":"2026-10-26T18:10:00.000Z","status":"Analyzed","sourceIdentifier":"cna@mongodb.com","cvss":{"version":"4.0","score":7.1,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-1325"],"affected":["mongodb/mongodb"],"epss":{"score":0.00258,"percentile":0.17319,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://jira.mongodb.org/browse/SERVER-122449","tags":["Issue Tracking","Vendor Advisory"],"source":"cna@mongodb.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-8199","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}