CVE-2026-118383

Name of the Vulnerable Software and Affected Versions MongoDB Server versions prior to 9.0.7

Description A use-after-free issue exists in the replication component of MongoDB Server. This occurs when a newly elected replica set primary completes the catch-up process. The flaw can be triggered by requests that do not require authentication, potentially leading to unexpected server termination or arbitrary code execution within the server process context. Affected components include replica set members, as well as shard and config server replica set members of sharded clusters. Standalone mongod instances are not affected. A use-after-free is a memory corruption flaw where the program continues to use a pointer after the memory it points to has been freed.

Recommendations Update to version 9.0.7.