CVE-2026-89099
Received Received - Intake

Race Condition in MongoDB Server Memory Corruption

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MongoDB, Inc.

Description
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89099
EUVD
EUVD-2026-76165

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in MongoDB Server's document value layer. It allows concurrent server threads to access and modify the same internal memory without proper synchronization, which can lead to memory corruption. An authenticated user with read-write privileges could exploit this to cause server termination or corrupt process memory with user-controlled data, affecting the server's confidentiality, integrity, and availability.

Detection Guidance

This vulnerability involves a race condition in MongoDB's document value layer. Detection typically requires monitoring for server crashes or memory corruption during concurrent operations. Check MongoDB logs for abnormal terminations or errors related to memory access. Use system monitoring tools like 'dmesg' or 'journalctl' to identify crashes. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker with basic database access to crash the MongoDB server or corrupt its memory. This may result in data loss, unauthorized data access, or service disruption, impacting the stability and security of the affected system.

Compliance Impact

This vulnerability could lead to unauthorized data access or corruption, violating confidentiality and integrity requirements in GDPR and HIPAA. A successful exploit may result in data breaches, non-compliance with data protection regulations, and potential legal consequences.

Mitigation Strategies

Apply the latest MongoDB server patch immediately. Restrict database access to trusted users only. Monitor server stability closely after applying updates. Disable unnecessary features that may increase concurrency risks. Follow MongoDB's official security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89099. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart