Vulnerability DatabaseCVE-2026-118383
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-118383
Published:November 10, 2026
Updated:November 12, 2026
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
Affected Packages
https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r5.0.0 <r5.0.35 || >=r5.0.0-alpha <r5.0.35 || =r4.5.0 <r5.0.35 || >=r4.7.0-alpha <r5.0.35 || =r4.8.0-alpha <r5.0.35 || >=r4.9.0-alpha <r5.0.35
Fix Suggestion:
Update to version r5.0.35
https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r8.3.0 <r8.3.16 || >=r8.3.0-alpha0 <r8.3.16 || >=r8.1.0 <r8.3.16 || >=r8.1.0-alpha <r8.3.16 || >=r8.2.0 <r8.3.16 || >=r8.2.0-alpha <r8.3.16
Fix Suggestion:
Update to version r8.3.16
https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r7.0.0 <r7.0.48 || >=r7.0.0-alpha <r7.0.48 || >=r6.1.0-alpha <r7.0.48 || >=r6.2.0-alpha <r7.0.48 || >=r6.3.0-alpha <r7.0.48
Fix Suggestion:
Update to version r7.0.48
https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r8.0.0 <r8.0.37 || >=r8.0.0-alpha <r8.0.37 || >=r7.1.0-alpha <r8.0.37 || >=r7.2.0-alpha <r8.0.37 || >=r7.3.0-alpha <r8.0.37
Fix Suggestion:
Update to version r8.0.37
https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r4.4.0 <r4.4.32 || >=r4.4.0-rc0 <r4.4.32
Fix Suggestion:
Update to version r4.4.32
https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r6.0.0 <r6.0.30 || >=r6.0.0-alpha <r6.0.30 || >=r5.1.0-alpha <r6.0.30 || >=r5.2.0-alpha <r6.0.30 || >=r5.3.0-alpha <r6.0.30
Fix Suggestion:
Update to version r6.0.30
https://github.com/mongodb/mongo.git (GITHUB):
Affected version(s) >=r9.0.0-alpha0 <r9.0.7
Fix Suggestion:
Update to version r9.0.7
Related Resources (2)
https://jira.mongodb.org/browse/SERVER-138175
https://jira.mongodb.org/browse/SERVER-138119
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
CVSS v3
Base Score:
9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Use After Free
CWE-416
EPSS
Base Score:
0.71