CVE-2026-82058: CWE-248: Uncaught Exception in MongoDB MongoDB Server
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range numeric indices.
AI Analysis
Technical Summary
This vulnerability in MongoDB Server occurs in the JSON Schema validation error generation code. When a BSON document contains an array with a malformed numeric field name that fails a $jsonSchema items type constraint, the error path performs unsafe numeric conversion on the user-controlled field name without proper exception handling. Because the wire protocol BSON validation does not enforce valid numeric indices for array elements, this can cause an uncaught exception that crashes the mongod server. The issue affects specific versions of MongoDB Server, namely 7.0.0, 8.0.0, and 8.3.0.
Potential Impact
An authenticated user with readWrite privileges can cause a denial of service by crashing the MongoDB server process. This disrupts availability but does not indicate direct data compromise or privilege escalation from the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict readWrite access to trusted users and monitor for unusual server crashes.
CVE-2026-82058: CWE-248: Uncaught Exception in MongoDB MongoDB Server
Description
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range numeric indices.
CVSS v4.0
Score 7.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in MongoDB Server occurs in the JSON Schema validation error generation code. When a BSON document contains an array with a malformed numeric field name that fails a $jsonSchema items type constraint, the error path performs unsafe numeric conversion on the user-controlled field name without proper exception handling. Because the wire protocol BSON validation does not enforce valid numeric indices for array elements, this can cause an uncaught exception that crashes the mongod server. The issue affects specific versions of MongoDB Server, namely 7.0.0, 8.0.0, and 8.3.0.
Potential Impact
An authenticated user with readWrite privileges can cause a denial of service by crashing the MongoDB server process. This disrupts availability but does not indicate direct data compromise or privilege escalation from the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict readWrite access to trusted users and monitor for unusual server crashes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-08-27T22:51:28.186Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6aa03a25acd9273b49ec362f
Added to database: 09/08/2026, 16:39:01 UTC
Last enriched: 09/08/2026, 16:53:22 UTC
Last updated: 09/09/2026, 00:22:56 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.