---
id: CVE-2026-89099
title: >-
  A race condition in the document value layer of MongoDB Server can allow
  concurrent server threads to operate on the same internal memory without
  synchronization, leading to memory corruption
summary: >-
  A race condition in the document value layer of MongoDB Server can allow
  concurrent server threads to operate on the same internal memory without
  synchronization, leading to memory corruption. An authenticated user holding
  ordinary read-…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-362
vendor: MongoDB
product: MongoDB Server
affected:
  - server >= 8.3.0 < 8.3.11
  - server >= 8.0 < 8.0.32
  - server >= 7.0 < 7.0.43
published: '2026-09-11'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:05:01.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89099'
references:
  - url: 'https://jira.mongodb.org/browse/SERVER-134063'
    label: cna@mongodb.com
tags:
  - nvd
  - cve.org
epss: 0.00316
epssPercentile: 0.21809
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-11T17:59:07.755467Z'
ingestedAt: '2026-09-14T00:35:28.535Z'
---

## Overview

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.