{"id":"CVE-2026-8843","title":"Creating a \"2dsphere_bucket\" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server","summary":"Creating a \"2dsphere_bucket\" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating \"querya…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-617"],"vendor":"mongodb","product":"mongodb","affected":["mongodb >= 7.0.0, < 7.0.32","mongodb >= 8.0.0, < 8.0.21","mongodb >= 8.2.0, < 8.2.6"],"patched":["mongodb 8.2.6"],"published":"2026-05-18","updated":"2026-09-24","sourceUpdated":"2026-09-24T17:31:28.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8843","references":[{"url":"https://jira.mongodb.org/browse/SERVER-116327","label":"cna@mongodb.com"}],"tags":["nvd"],"epss":0.00235,"epssPercentile":0.14673,"ingestedAt":"2026-09-24T17:48:30.380Z","slug":"CVE-2026-8843","body":"## Overview\n\nCreating a \"2dsphere_bucket\" index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating \"queryable_encrypted_range\" indices.\n\nThis issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6\n\n## Affected\n\n- `mongodb >= 7.0.0, < 7.0.32`\n- `mongodb >= 8.0.0, < 8.0.21`\n- `mongodb >= 8.2.0, < 8.2.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `mongodb 8.2.6`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}