CVE-2026-89099 Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption
An authenticated user can trigger a race condition in MongoDB Server causing memory corruption and potential code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89099?
CVE-2026-89099 is a high-severity vulnerability in Mongodb Mongodb, published on 11 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.
Weakness: CWE-362
Which versions are affected by CVE-2026-89099?
1 open source package ship an affected version, including mongodb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mongodb Bitnami | From 7.0.0 | 7.0.43, 8.0.32, 8.3.11, 9.0.2 |
Products include Mongodb Mongodb.
How do I fix CVE-2026-89099?
Upgrade mongodb to a fixed version for your release line: 7.0.43, 8.0.32, 8.3.11 or 9.0.2.
Is CVE-2026-89099 being exploited?
There is no known exploitation of CVE-2026-89099 in the wild and no public exploit code.
Other vulnerabilities in Mongodb Mongodb
- CVE-2025-14847 MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency
- CVE-2026-82067 Auth bypass in MongoDB Server
- CVE-2026-13072 MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption
- CVE-2017-15535 Denial of service in n/a
- CVE-2026-18691 Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
Sources
Also known as BIT-mongodb-2026-89099, GHSA-fjcj-f5cf-235q, MINI-73hp-pvc7-87w8, MINI-8454-7hcv-46wr, MINI-g9f4-c8mw-mj44, UBUNTU-CVE-2026-89099.