CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet,...

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Ghostwire Analysis — What This Means Practically

Exploitation Probability (EPSS): Low — 0.04% (12th percentile)

Low exploitation probability based on current threat landscape data. Standard patching timeline is appropriate.

High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

CVE-2026-8199: An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet,...

Description

Ghostwire Analysis — What This Means Practically

Security Coverage (2 articles)

References