CVE-2026-8199 is an authenticated memory exhaustion vulnerability in MongoDB Server caused by improperly controlled sequential memory allocation during the processing of bitwise match expressions ($bitsAllSet, $bitsAnySet, $bitsAllClear, $bitsAnyClear). This flaw can be exploited by an authenticated user to induce excessive memory consumption, potentially leading to out-of-memory conditions and service unavailability. The vulnerability affects multiple MongoDB Server versions prior to specified patch levels. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no user interaction, and high impact on availability. There is no vendor advisory or patch link provided, and the remediation level is unspecified.

An authenticated user can trigger excessive memory usage in affected MongoDB Server versions by exploiting the bitwise match expression processing flaw. This can cause memory pressure that may lead to out-of-memory (OOM) conditions, resulting in denial of service due to availability loss. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit authenticated user permissions to trusted users only and monitor memory usage to detect potential exploitation attempts. Avoid using the affected bitwise match expressions if possible. Do not assume the vulnerability is mitigated without vendor confirmation.