This vulnerability (CVE-2026-8202) involves the MongoDB aggregation operators $trim, $ltrim, and $rtrim. When an authenticated user with aggregation permissions uses a densely populated character mask combined with a large input string, it can cause the MongoDB server to consume excessive CPU resources, effectively causing a denial of service through resource exhaustion. The issue affects MongoDB Server versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2. The vulnerability is categorized under CWE-770, which relates to allocation of resources without limits or throttling. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and low impact on confidentiality, integrity, and availability except for limited availability impact due to resource exhaustion.

An authenticated user with aggregation permissions can cause sustained 100% CPU utilization on the MongoDB server by exploiting this vulnerability. This can degrade server performance and availability, potentially impacting legitimate database operations. The impact is limited to resource exhaustion without direct compromise of data confidentiality or integrity. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting aggregation permissions to trusted users only and monitor server performance for unusual CPU usage patterns related to aggregation queries involving $trim, $ltrim, and $rtrim operators. Avoid processing large input strings with densely populated character masks in these operators where possible.