CVE-2026-8199
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
May 13, 2026
CISA due date
—
The record
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-1325
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-1325
- CVE-2026-71436 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify… CWE-1325
- CVE-2026-34183 Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by… CWE-1325
- CVE-2026-6869 WebSocket protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows… CWE-1325
- CVE-2026-6867 SMB2 protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows… CWE-1325
- CVE-2026-6533 Dissection engine LZ77 decompression crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to… CWE-1325
- CVE-2026-6535 Dissection engine zlib decompression crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to… CWE-1325