Security · High impactFan score 65 · Tier A
CVE-2026-118383: Use-after-free vulnerability in MongoDB
The Brief
- Datadog Security Labs reproduced CVE-2026-118383, a use-after-free vulnerability in MongoDB Server's primary catch-up process.
- Unauthenticated clients can set up the condition that triggers the flaw, according to the source.
- The source describes the vulnerability as critical and explains how to detect and remediate it.
Why it matters
Operators of MongoDB Server deployments may be exposed to a critical memory-safety flaw that unauthenticated clients can reach, so checking whether their deployments are affected is a priority.
Who’s affected
- MongoDB Server operators
What to do
- Review Datadog Security Labs' detection and remediation guidance for CVE-2026-118383
- CVE-2026-118383
- #mongodb
- #security
- #vulnerability
- #use-after-free
- #database
We reproduced CVE-2026-118383, a critical use-after-free in MongoDB Server's primary catch-up process that unauthenticated clients can set up, and explain how to detect and remediate it.
Timeline
Datadog Security Labs published its reproduction of CVE-2026-118383 with detection and remediation guidance
Datadog Security Labs
CVE-2026-118383: Use-after-free vulnerability in MongoDB