CVE-2026-82058

CVE-2026-82058 is an uncaught-exception denial-of-service flaw in MongoDB's (mongod) $jsonSchema validation error-generation code. An authenticated user with readWrite privileges can terminate the server by sending a BSON document whose array contains a malformed numeric field name; when that document fails an 'items' type constraint, the error path performs an unchecked numeric conversion on the attacker-controlled field name and the process crashes. The impact is full availability loss for the mongod instance (CVSS 4.0 availability impact High), with no confidentiality or integrity impact. The affected version ranges are not specified in the source data, so defenders should consult MongoDB's advisory for the fixed releases. No public proof-of-concept, KEV listing, or observed exploitation is known, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade mongod to the fixed release identified in MongoDB's advisory for CVE-2026-82058 (fixed version numbers are not listed in this dataset). As an interim mitigation, remove or relax $jsonSchema validators that use 'items' type constraints on collections writable by ordinary users, and restrict readWrite grants to trusted service accounts. Investigate any mongod crash following inserts into schema-validated collections and review mongod logs for uncaught exceptions.