MongoDB Server: Use-after-free in classic query engine plan cache
Summary
A use-after-free flaw in the classic query engine plan cache of MongoDB Server can expose server process memory. An authenticated user who runs update or bulkWrite commands with a sort specification can later trigger a read of freed memory through $planCacheStats, and the data is returned to the client. Under certain heap reuse conditions, the server may also crash. The CVSS 4.0 base score is 6.0 (MEDIUM).
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- Versions before 7.0.0: Unknown.
- The CNA record states the default configuration is unaffected.
Fixed in
- MongoDB Server 9.0.7 or later
- MongoDB Server 8.3.16 or later
- MongoDB Server 8.0.37 or later
- MongoDB Server 7.0.48 or later
- Jira fix versions also list 9.1.0-rc0 and 9.1.0-rc1025.
Workaround
Unknown. No vendor-documented workaround was found. Upgrading is the only remediation in the sources reviewed.
Exploitation
- No reports of exploitation in the wild were found in the sources reviewed.
- No public exploit is known. The reproducer is restricted by the vendor (SECBUG-1570).
- MongoDB confirmed the issue under AddressSanitizer as a heap-use-after-free.
Our recommendation
- Inventory all MongoDB instances and their versions.
- Upgrade each instance to the fixed version of its release line (7.0.48, 8.0.37, 8.3.16 or 9.0.7 and later). Verify the version on MongoDB's download page before rollout.
- Do not expose MongoDB to the internet. Restrict network access to trusted hosts.
- Review which accounts can authenticate and remove unneeded access.
- Recheck the MongoDB advisory and the NVD entry in a few days, because the NVD analysis was still pending at publication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MongoDB Jira ticket SERVER-135353 jira.mongodb.org
- Strix AI: CVE-2026-120811 www.strix.ai
- ThreatInt: CVE-2026-120811 cve.threatint.com
- MongoDB 9.0 release notes www.mongodb.com
- MongoDB Community Forum: MongoDB 9.0.7 is released www.mongodb.com
- MongoDB downloads archive www.mongodb.com
- SecurityOnline: MongoDB CVE-2026-118383 fixed in same release line securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:46.
Original description (NVD)
A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.