MongoDB Server: Uncontrolled resource consumption in encrypted-field statistics
Summary
MongoDB Server keeps an in-memory table of per-namespace statistics for operations with encrypted-field information. An entry is created for every namespace named in a request and is never removed unless a real encrypted collection is dropped. An authenticated user with basic read privileges can repeatedly send read commands with arbitrary namespace names, causing memory use to grow steadily and performance to degrade until the server process is restarted. The flaw affects availability only.
Affected
- MongoDB Server 9.0.0 before 9.0.7
- MongoDB Server 8.3.0 before 8.3.16
- MongoDB Server 8.0.0 before 8.0.37
- Default configuration: unaffected (according to the CVE record)
- Other branches: Unknown.
Fixed in
- MongoDB Server 9.0.7
- MongoDB Server 8.3.16
- MongoDB Server 8.0.37
- Fix versions 9.1.0-rc0 and 9.1.0-rc1025 are also listed in the Jira ticket.
Workaround
- No vendor workaround known.
- Limit read roles to trusted users only.
- Keep MongoDB off public networks.
- Monitor server memory usage and restart the service if memory grows abnormally (this only reclaims memory, it does not fix the flaw).
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- No public proof of concept found at the time of research.
Our recommendation
- Upgrade to MongoDB Server 9.0.7, 8.3.16 or 8.0.37, or a later release, in the next regular maintenance window; sooner if MongoDB is reachable from the internet or shared by many applications.
- Install the same release together with the fixes for other MongoDB CVEs published on the same day.
- Review which accounts and applications hold read roles and remove unneeded access.
- Monitor memory usage of mongod and mongos processes.
- Confirm the fixed builds in the MongoDB Jira ticket, as the NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-120820 www.cve.org
- MongoDB Jira SERVER-135737 jira.mongodb.org
- MongoDB Server serverStatus documentation www.mongodb.com
- OpenCVE CVE-2026-120820 app.opencve.io
- Strix CVE-2026-120820 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:16.
Original description (NVD)
MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.