CVE-2026-82075

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: MongoDB, Inc.

Description

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-82075

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is an uncontrolled resource consumption weakness in MongoDB's sharded-cluster router process. An unauthenticated client with network access can send connection-monitoring parameters that cause the server to use excessive CPU resources without rate limiting, leading to service degradation or denial for legitimate users.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual CPU usage patterns on MongoDB sharded-cluster router processes. Check for sustained high CPU usage on router ports without corresponding authenticated connections. Use system monitoring tools like top, htop, or ps to observe process CPU consumption. Network monitoring tools like tcpdump or Wireshark can help identify excessive connection attempts to router ports.

Impact Analysis

This vulnerability can degrade or deny service to legitimate clients by consuming excessive CPU resources on the MongoDB router. It does not affect data confidentiality or integrity, but may cause downtime or reduced performance for the database service.

Compliance Impact

This vulnerability primarily impacts availability, which may lead to service disruptions. While it does not directly affect data confidentiality or integrity, prolonged downtime could potentially violate availability requirements in GDPR or HIPAA if it impacts systems handling protected data.

Mitigation Strategies

Immediately restrict network access to MongoDB router ports using firewalls or security groups. Enable authentication for all connections to the router. Update MongoDB to the latest patched version if available. Monitor CPU usage on router processes and set up alerts for abnormal spikes. Consider temporarily disabling connection-monitoring features if not required.

Hi! I’m here to help you understand CVE-2026-82075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70