---
id: "CVE-2026-120811"
page: "https://infrastack.ai/live/CVE-2026-120811"
kind: "vulnerability"
aliases: ["CVE-2026-120811"]
title: "MongoDB: plan cache use-after-free can leak server memory to clients"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["database", "mongodb", "package", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-11-10T20:18:51+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T20:48:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120811", "first_seen_at": "2026-11-10T20:46:02+00:00"}]
exploit_sources: []
---

# MongoDB: plan cache use-after-free can leak server memory to clients

Link for people: https://infrastack.ai/live/CVE-2026-120811 (this .md is for agents)

A use-after-free bug in MongoDB's classic query engine plan cache lets a diagnostic command read freed heap memory. An authenticated client may receive sensitive server process memory contents, and under some heap reuse conditions the server can crash.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120811

## From the sources

A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_