CVE-2026-8843 Details
Description
Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating "queryable_encrypted_range" indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6
A vulnerability exists in MongoDB Server in versions 7.0 prior to 7.0.32, 8.0 prior to 8.0.21, and 8.2 prior to 8.2.6. The issue arises when a '2dsphere_bucket' index is created on a non-timeseries bucket collection. While the index creation will succeed, any subsequent insertion of a document that updates the index will cause the server to crash. A similar problem occurs with 'queryable_encrypted_range' indices. The vulnerability is triggered by creating these invalid indices, which are then accessed through document insertions, leading to a server failure.
Users can upgrade to MongoDB Server versions 8.3.0-rc0, 8.2.6, or 8.0.21 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jira.mongodb.org/browse/SERVER-116327 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mongodb mongodb | >= 7.0.0, < 7.0.32 >= 8.0.0, < 8.0.21 >= 8.2.0, < 8.2.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | New CVE Received | [email protected] |