CVE-2026-4358 Details
Description
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
A memory management vulnerability has been identified in MongoDB's aggregation framework, specifically within the slot-based execution (SBE) engine. This issue arises when an authenticated user with write privileges executes a $lookup operation that triggers a hash table spill from memory to disk. Under these circumstances, the SBE engine improperly handles memory, leading to a double-free or use-after-free error. The vulnerability affects MongoDB versions 8.2.2 and 8.0.16.
Users can upgrade to MongoDB versions 8.3.0-rc0, 8.0.20, or 7.0.31, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jira.mongodb.org/browse/SERVER-118849 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mongodb mongodb | >= 7.0.0, < 7.0.31 >= 8.0.0, < 8.0.20 >= 8.2.0, < 8.2.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Mar 17, 2026 | New CVE Received | [email protected] |