---
id: CVE-2026-82064
title: >-
  A security issue in MongoDB Server allows an unauthenticated network user to
  cause a denial of service on a specific type of replica set member
summary: >-
  A security issue in MongoDB Server allows an unauthenticated network user to
  cause a denial of service on a specific type of replica set member. The server
  contains an assertion in its read concern processing logic that can be reached
  wi…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-617
vendor: mongodb
product: mongodb
affected:
  - 'mongodb >= 7.0.0, < 7.0.41'
  - 'mongodb >= 8.0.0, < 8.0.30'
  - 'mongodb >= 8.3.0, < 8.3.9'
patched:
  - mongodb 8.3.9
published: '2026-09-08'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:37:20.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82064'
references:
  - url: 'https://jira.mongodb.org/browse/SERVER-130759'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
epss: 0.00287
epssPercentile: 0.21478
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-08T17:57:53.527923Z'
ingestedAt: '2026-09-08T16:34:19.257Z'
---

## Overview

A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.

## Affected

- `mongodb >= 7.0.0, < 7.0.41`
- `mongodb >= 8.0.0, < 8.0.30`
- `mongodb >= 8.3.0, < 8.3.9`

## Remediation

Upgrade past the affected range:

- `mongodb 8.3.9`