MongoDB Server: Use-after-free Denial of Service (CVE-2026-118383)

A critical use-after-free vulnerability, tracked as CVE-2026-118383, affects MongoDB replica set members, including shard and config server nodes in sharded clusters. An unauthenticated attacker can send two crafted ping commands containing a readConcern.afterOpTime value, which plants notification waiters on the server. If that replica member is later elected as the primary, the accumulated waiters trigger a double-cleanup of memory during the catch-up phase, leading to a segmentation fault and service disruption. Standalone mongod instances are not affected.

Impact

Successful exploitation results in a database service crash. While the researchers did not achieve arbitrary code execution in lab conditions, MongoDB acknowledged that the flaw may lead to arbitrary code execution under certain conditions. The impact is primarily a denial of service (DoS) in distributed MongoDB environments.

Recommendation

• Apply security patches provided by MongoDB for all replica set members immediately.
• Verify that all replica set members, including those in containers or temporarily offline during maintenance, are running the patched versions.
• Restrict network access to database infrastructure to authorized systems to prevent unauthenticated exploitation of the ping command.
• For MongoDB Atlas users, ensure automatic maintenance windows are active or perform manual upgrades if deferred.