# CVE-2026-118383

Use-after-free in MongoDB replication may crash servers or allow unauthenticated RCE.

- Page: https://www.vulneraibility.com/cve/CVE-2026-118383
- CVSS: 9.5
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-416
- Published: 2026-11-10

## Affected versions

- MongoDB MongoDB Server: affected >= 9.0.0 and < 9.0.7; >= 8.3.0 and < 8.3.16; >= 8.0.0 and < 8.0.37; >= 7.0.0 and < 7.0.48; >= 6.0.0 and < 6.0.30; >= 5.0.0 and < 5.0.35; >= 4.4.0 and < 4.4.32

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated requests during replica primary catch-up can crash mongod or enable arbitrary code execution in the server process.

## Action

Immediate action required

## Recommendation

Isolate replica sets, block unauthenticated access, restrict network exposure, and apply vendor patch when released.

## References

- [other] https://jira.mongodb.org/browse/SERVER-138119
- [other] https://jira.mongodb.org/browse/SERVER-138175

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.