MongoDB Server 9.0.7 Fixes CVE-2026-118383 Use-After-Free

Entenda a falha

A vulnerabilidade

MongoDB released 9.0.7 and six maintenance updates fixing 26 MongoDB Server flaws (2 critical, 16 high, 8 medium). The worst is CVE-2026-118383 (CVSS 9.5), a use-after-free (CWE-416) in replication code. An unauthenticated attacker with network access can crash the host or run arbitrary code on replica set members, shard nodes and config servers; standalone mongod hosts are not affected. CVE-2026-120808 (CVSS 9.1) is a certificate validation flaw (CWE-295) in macOS builds using Apple SecureTransport: for IPv6 peers an on-path attacker with a self-signed certificate can intercept and alter TLS traffic. The rest include other use-after-free bugs, memory exhaustion (CVE-2026-120828, CVE-2026-120804) and authorization/encryption bypasses (CVE-2026-120815, CVE-2026-120822, CVE-2026-120813). Affected: 9.0 before 9.0.7, 8.3 before 8.3.16, 8.0 before 8.0.37, 7.0 before 7.0.48; CVE-2026-118383 and CVE-2026-120828 also hit 6.0 before 6.0.30, 5.0 before 5.0.35 and 4.4 before 4.4.32.

Como funciona

For CVE-2026-118383, a replica set elects a new primary, which then runs a catch-up step to sync with other members. When that step finishes, the replication code uses memory that has already been freed. Network requests from an unauthenticated client reach this code, so the stale memory can lead to a crash or, in the worst case, code execution. For CVE-2026-120808, when a macOS MongoDB process connects to an IPv6 peer over TLS, the code calls SecTrustEvaluate but discards its trust result, so the connection is accepted even if the certificate should have been rejected.

Por que é vulnerável

CVE-2026-118383 is a memory-lifetime error: after the new primary completes catch-up, the replication code keeps using an object that was freed (use-after-free). CVE-2026-120808 is a missing check: the result of the certificate trust evaluation is dropped on the IPv6 path, so validation never takes effect. The articles do not explain why these went unnoticed. The fix is delivered in the patched releases, and the articles do not detail the code changes.

Onde está

The articles name no file, function or commit; they only place CVE-2026-118383 in the replication code (end of the new primary's catch-up) and CVE-2026-120808 in the SecureTransport TLS path on macOS (the SecTrustEvaluate result on IPv6 connections).

Como foi descoberta

According to the report, internal MongoDB developers found 14 of the 26 flaws and outside researchers reported the other 12. The articles do not name the researchers or say how the individual bugs were found. They were disclosed through MongoDB's release of 9.0.7 and the maintenance updates. No active exploitation has been confirmed.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 00:15.