CVE-2026-8201

MEDIUM

6.4

Descricao

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

Detalhes CVE

Pontuacao CVSS v3.16.4

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Vetor de ataqueNETWORK

ComplexidadeHIGH

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado5/13/2026

Ultima modificacao5/13/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

mongodb:mongodb

Fraquezas (CWE)

CWE-416

Referencias

https://jira.mongodb.org/browse/SERVER-122032(cna@mongodb.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.