A critical flaw in MongoDB Server (CVE-2026-118383), rated 9.5 CVSS, allows unauthenticated attackers to trigger server crashes via a use-after-free during replica set catch-up cleanup.
MongoDB released patches and notes no active exploitation.
How is collapse caused?
The issue is specific to servers that operate in clusters, where multiple servers maintain the same data for backup purposes. Normally, one of them acts as the master server and handles all new registrations, while the others follow suit. If the master server goes down, the others go through an election process to elect a new leader.
According to security researchers, the crash can occur if two special requests are sent to a server that is lagging behind in data updates. If that server is later elected to become the new group leader, completing the process causes a serious internal memory error. This leads to an immediate crash of the new primary server before it can accept new records.
What about attacks and fixes?
The company rated the issue a 9,5 out of 10 on the severity scale. It said it discovered the flaw itself and is not aware of any attempts to exploit it in real-world attacks. Security researchers were able to replicate the issue in a lab environment and published their findings.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Urgent update for Node.js: 16 security vulnerabilities fixed
↗
The company's automated cloud services receive the necessary updates automatically during maintenance. However, those who manage their own systems must install the patched version on each member of the server group. It is noted that an older software series reached end-of-life in late July and is no longer receiving patches.
Researchers advise restricting network access to the database as a temporary protection measure until the updates are installed.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
