CVE-2026-82054

CVE-2026-82054 is an uncontrolled resource consumption flaw (CWE-770) in the JSON Pointer parser of MongoDB Server, triggered when that parser processes the $jsonSchema field of a query filter during a find command. A remotely authenticated attacker with low privileges can send a specially crafted $jsonSchema filter that the parser processes without any cap on iteration count or total allocation size, causing severe memory amplification inside the mongod process. Because the attack requires no user interaction and can be repeated across concurrent requests, an attacker can drive cumulative heap usage past the limit, letting the server's out-of-memory handler terminate mongod and deny service to every connected client. All deployments of MongoDB Server that accept find queries from users able to supply $jsonSchema filters are affected; no fixed version numbers or affected version ranges were provided in the available data. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS assigns it a 0.3% probability of exploitation within 30 days.

What to do: Because no fixed version is specified in the available data, track MongoDB's security advisory for CVE-2026-82054 and apply the patched MongoDB Server release as soon as it is published. Until then, limit database accounts to trusted, least-privilege users (the vector requires authenticated find access), restrict or validate any client-supplied $jsonSchema filters at the application layer, and cap mongod memory via container/cgroup or OS-level limits with heap and OOM monitoring so a single crash is contained. Review logs for unexpected mongod restarts or OOM-kill events, which would indicate attempted or successful DoS.