MongoDB Server: Memory exhaustion via abandoned read-concern waiters
Summary
MongoDB Server replica-set nodes do not limit or reclaim internal wait records created when handling a client-supplied read option that names a point in time the node never reaches. An unauthenticated attacker with network access to the database port can make these records accumulate and persist after the requests end. This may exhaust server memory and make the database unavailable (denial of service).
Affected
- MongoDB Server 9.0.0 to before 9.0.7
- MongoDB Server 8.3.0 to before 8.3.16
- MongoDB Server 8.0.0 to before 8.0.37
- MongoDB Server 7.0.0 to before 7.0.48
- MongoDB Server 6.0.0 to before 6.0.30
- MongoDB Server 5.0.0 to before 5.0.35
- MongoDB Server 4.4.0 to before 4.4.32
- Default configuration: unaffected
- Versions 3.x and older: Unknown.
Fixed in
- 9.0.7
- 8.3.16
- 8.0.37
- 7.0.48
- 6.0.30
- 5.0.35
- 4.4.32
Workaround
- No vendor workaround is listed.
- Interim measure (not vendor-sourced): restrict network access to mongod ports to known hosts only.
Exploitation
- Not known to be exploited, according to OffSeq at the time of research.
- No public proof of concept, Metasploit or Exploit-DB entry, or CISA KEV listing was found.
- Exploitation requires only network access to the database port and no credentials.
Our recommendation
- Check whether any MongoDB Server instance, especially replica-set nodes, is reachable from untrusted networks.
- Update affected instances to the fixed versions listed above, in the same maintenance window as other recent MongoDB patches.
- Until patched, restrict access to the mongod port to trusted application servers and administrators.
- Monitor memory usage of database servers for unusual growth and check NVD and CISA KEV once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Jira SERVER-138119 (MongoDB vendor ticket) jira.mongodb.org
- CVE Record CVE-2026-120828 (CNA: MongoDB) www.cve.org
- MongoDB Security Alerts www.mongodb.com
- Strix CVE-2026-120828 www.strix.ai
- OffSeq Radar CVE-2026-120828 radar.offseq.com
- MongoDB Community Download (product reference) www.mongodb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 00:58.
Original description (NVD)
A replica-set database server node does not limit or reclaim internal wait records created while handling a client-supplied read option that names a point in time the node will never reach. A party with network access and no credentials can cause these records to accumulate without bound and persist after the requests end, which may make the server run out of memory and become unavailable.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.