Critical MongoDB Flaw Lets Attackers Crash Database Servers With Just Two Ping Requests

MongoDB has patched a critical flaw, tracked as CVE-2026-118383, that can let a remote attacker with no login crash a database server using two simple ping requests. The bug carries a CVSS v4.0 score of 9.5.

It sits in the replication code that runs when a new primary server finishes catching up. MongoDB announced the fix on November 10, 2026, and said it found the problem internally. The company said it knows of no attempts to abuse it.

MongoDB Database Crash Vulnerability

The GitHub advisory describes a use-after-free bug. This means the program keeps using a piece of memory after it has already been released.

The advisory says requests that need no authentication can trigger the condition. The result may be a sudden server shutdown. Under some conditions, it could also be arbitrary code execution inside the server process.

Only replica set members are affected. That includes the shard and config server members in sharded clusters. A standalone mongod instance does not run the catch-up step, so it is safe from this bug.

Researchers at Datadog Security Labs explained the chain. When a replica set member wins an election, it first applies writes it missed. Only then does it accept new ones. The bug lives in the cleanup at the end of that step.

Vulnerable servers accept a ping command before login. An attacker sends two of them with a readConcern.afterOpTime value. Each one leaves behind a pending notification, which MongoDB calls a waiter. These waiters do nothing at first. They stay in place until the member restarts, rolls back, or steps down.

The crash needs two more things the attacker cannot control. One member must fall behind, and that same member must then win an election. This can happen during maintenance or an outage.

When catch-up ends, the cleanup runs twice and touches freed memory. The server then crashes before it takes any writes. Turning on authentication does not stop the first step.

Datadog built a four-member replica set and forced the lag and failover itself. On MongoDB 8.0.34 with both ping requests sent, the new primary logged a segmentation fault, and the process crashed.

Without the requests, the same failover worked fine. On patched 8.0.37, the server rejected both requests as Unauthorized and kept running.

The team did not achieve code execution. It also warned that its roughly 40-second test time says nothing about real-world speed. The attacker cannot see or choose the timing window, which is why the CVSS rating lists attack complexity as high.

MongoDB’s fixed releases are 9.0.7, 8.3.16, 8.0.37, 7.0.48, 6.0.30, 5.0.35, and 4.4.32. Atlas clusters upgrade during maintenance. MongoDB urges customers who deferred maintenance to apply the update soon.

Admins running their own servers should check the version on every member, including containers and nodes that were offline during patching.

If you cannot upgrade right away, limit network access to the systems that truly need it. This reduces who can send the ping requests but does not fix the bug.

A crashed primary can leave a cluster without a writer until another member takes over. In Datadog’s test, the cluster stayed without a primary.

Datadog advises checking structured server logs for slow-query entries from ping commands that include readConcern.afterOpTime and an expired wait.

Also look for a member that leaves catch-up twice in one transition, followed by a fatal signal that mentions CatchupState::abort_inlock(). Logging settings decide whether these fields appear, so confirm your logs keep the full command.

This is not the first pre-login MongoDB problem this year. Cybersecuritynews.com covered CVE-2026-25611, a compression bug that let unauthenticated users crash servers using little bandwidth.

It also covered MongoBleed, the memory leak flaw that was exploited in the wild soon after disclosure. MongoBleed shows how fast attackers move once details are public.

Teams should patch this latest flaw before that happens again, and they should keep database ports off the open internet. The NVD entry for CVE-2026-118383 lists the official record, and MongoDB’s tracking tickets are SERVER-138119 and SERVER-138175.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical MongoDB Flaw Lets Attackers Crash Database Servers With Just Two Ping Requests appeared first on Cyber Security News.