CVE-2026-82055

CVE-2026-82055 is a null pointer dereference (CWE-476) in the index key generation of MongoDB's 2dsphere geospatial index that crashes the mongod server process. It is triggered when an authenticated user with write privileges inserts a specially crafted GeoJSON document into a collection with a 2dsphere index: inconsistent geometry parsing leaves an internal object partially initialized, and the subsequent key-generation step dereferences it, terminating the server. An attacker gains denial of service — repeated crafted inserts can keep crashing the database — with no confidentiality or integrity impact indicated. Any MongoDB deployment that allows write access to collections with 2dsphere indexes is affected; the specific affected version ranges were not provided in the source data. There is no known public proof-of-concept, it is not in the CISA KEV catalog, and EPSS assigns only a 0.3% chance of exploitation within 30 days.

What to do: Patch mongod to a fixed release as soon as MongoDB publishes the affected/fixed version matrix in its security advisory for CVE-2026-82055, since version ranges were not included in the source data. Until patched, restrict write access on 2dsphere-indexed collections to trusted principals, validate or constrain externally supplied GeoJSON, and alert on unexpected mongod restarts. Review whether any application code lets end users insert geospatial documents directly.