CVE-2026-4358 | BDVDB-2026-320883 Detail
MongoDBMongoDB Server
Description#
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact high. Attack vector: network.
Weaknesses#
- CWE-415 Double Free
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.