Critical MongoDB Flaw Lets Attackers Crash Database Servers With Just Two Ping Requests
Critical MongoDB flaw allows remote attackers to crash database servers with two ping requests.
MongoDB has patched a critical vulnerability, CVE-2026-118383, that allows unauthenticated remote attackers to crash database servers using two ping requests. The bug, a use-after-free flaw in the replication code, has a CVSS v4.0 score of 9.5 and affects replica set members. While MongoDB is unaware of any active exploitation, Datadog Security Labs demonstrated a successful crash on a vulnerable version.
AI summary of the linked source. Not reviewed by an editor. How this works
Run MongoDB?
Get an email when a new story names MongoDB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA use-after-free vulnerability in MongoDB's replication code (CVE-2026-118383) allows an unauthenticated attacker to crash a database server with just two crafted ping requests, earning a near-maximum CVSS v4.0 score of 9.5. The flaw targets replica set members, meaning a single successful attack can destabilize an entire database cluster, not just one node. Because no authentication is required, any network-accessible MongoDB instance running an unpatched version is at immediate risk of denial-of-service. This incident underscores how memory-safety bugs in core infrastructure components can have outsized availability consequences, and why rapid patch deployment for critical database systems is non-negotiable.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-118383