{"id":"CVE-2026-120820","kind":"vulnerability","aliases":["CVE-2026-120820"],"related":[],"title":"MongoDB Server: unbounded memory growth from arbitrary namespace names in reads","description":"MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process.","summary":"MongoDB Server keeps an in-memory table of per-namespace statistics for operations with encrypted-field information and adds an entry for every namespace named in a request, with no limit and no way to remove stale ones. A user with basic read privileges can send repeated read commands with made-up namespace names, causing the server process to grow in memory and slow down until it is restarted.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","infrastructure","mongodb","self-hosted"],"not_affected_if":["no-untrusted-read-users"],"how_to_check":"- Check the MongoDB Server version with `mongod --version` and compare it against the fixed versions below","fix":null,"status":"open","published_at":"2026-11-10T21:19:00+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:49:56+00:00","updated_at":"2026-11-10T21:49:56+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T21:49:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: unbounded memory growth from arbitrary namespace names in reads","impact":"low","summary":"MongoDB Server keeps an in-memory table of per-namespace statistics for operations with encrypted-field information and adds an entry for every namespace named in a request, with no limit and no way to remove stale ones. A user with basic read privileges can send repeated read commands with made-up namespace names, causing the server process to grow in memory and slow down until it is restarted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["mongodb","self-hosted","database"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"server memory grows until restart, causing slowdown or denial of service","analyst_note":"Sources list only NVD; confirm affected and fixed MongoDB Server versions and whether the encrypted-field path is enabled by default at https://nvd.nist.gov/vuln/detail/CVE-2026-120820","how_to_check":"- Check the MongoDB Server version with `mongod --version` and compare it against the fixed versions below\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-read-users"],"who_is_affected":"Deployments running MongoDB Server where users hold read privileges can trigger the growth, since the flawed table is filled by ordinary read commands naming arbitrary namespaces. Operators of single-tenant servers with only trusted read users are less exposed. The sources do not state which versions or configurations are affected beyond this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4626,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120820':14A,17A '-2026':13A,16A 'add':45B 'affect':183C 'amount':174C 'arbitrari':7A,162C 'basic':68B,152C 'carri':113C 'caus':82B,166C 'code':184C 'collect':148C 'command':75B,160C 'correspond':144C 'creat':120C 'cve':12A,15A 'databas':18B 'encrypt':41B,115C 'encrypted-field':40B,114C 'entri':47B,118C,135C,141C 'everi':49B 'field':42B,116C 'grow':87B 'growth':5A 'host':23B 'in-memori':28B,101C 'increas':173C 'inform':43B,117C 'infrastructur':19B 'issu':157C 'keep':26B 'limit':57B,130C 'made':78B 'made-up':77B 'maintain':99C 'may':165C 'memori':4A,30B,89B,103C,176C,187C 'mongodb':1A,20B,24B,97C 'name':9A,51B,81B,164C 'namespac':8A,35B,50B,80B,108C,123C,163C 'never':143C 'number':133C 'one':64B 'oper':38B,111C 'ordinari':158C 'path':185C 'per':34B,107C 'per-namespac':33B,106C 'privileg':70B,154C 'process':85B,169C,194C 'read':11A,69B,74B,153C,159C 'real':147C 'reclaim':189C 'referenc':161C 'remov':62B,140C 'repeat':73B,156C 'request':54B,127C 'restart':96B,192C 'retain':171C 'self':22B 'self-host':21B 'send':72B 'server':2A,25B,84B,98C,168C 'slow':91B,179C 'stale':63B 'statist':36B,109C 'steadili':172C 'suppli':124C 'tabl':31B,104C 'unbound':3A 'user':66B,150C 'way':60B,138C","nicknames":[],"mitigations":[],"who_affected":"Deployments running MongoDB Server where users hold read privileges can trigger the growth, since the flawed table is filled by ordinary read commands naming arbitrary namespaces. Operators of single-tenant servers with only trusted read users are less exposed. The sources do not state which versions or configurations are affected beyond this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","infrastructure","medium","mongodb","selfhosted"],"campaign_type":null,"search_a":"'-120820':14A,17A '-2026':13A,16A 'arbitrari':7A 'cve':12A,15A 'growth':5A 'memori':4A 'mongodb':1A 'name':9A 'namespac':8A 'read':11A 'server':2A 'unbound':3A","search_b":"'add':45B 'basic':68B 'caus':82B 'command':75B 'databas':18B 'encrypt':41B 'encrypted-field':40B 'entri':47B 'everi':49B 'field':42B 'grow':87B 'host':23B 'in-memori':28B 'inform':43B 'infrastructur':19B 'keep':26B 'limit':57B 'made':78B 'made-up':77B 'memori':30B,89B 'mongodb':20B,24B 'name':51B,81B 'namespac':35B,50B,80B 'one':64B 'oper':38B 'per':34B 'per-namespac':33B 'privileg':70B 'process':85B 'read':69B,74B 'remov':62B 'repeat':73B 'request':54B 'restart':96B 'self':22B 'self-host':21B 'send':72B 'server':25B,84B 'slow':91B 'stale':63B 'statist':36B 'tabl':31B 'user':66B 'way':60B","search_c":"'affect':183C 'amount':174C 'arbitrari':162C 'basic':152C 'carri':113C 'caus':166C 'code':184C 'collect':148C 'command':160C 'correspond':144C 'creat':120C 'encrypt':115C 'encrypted-field':114C 'entri':118C,135C,141C 'field':116C 'in-memori':101C 'increas':173C 'inform':117C 'issu':157C 'limit':130C 'maintain':99C 'may':165C 'memori':103C,176C,187C 'mongodb':97C 'name':164C 'namespac':108C,123C,163C 'never':143C 'number':133C 'oper':111C 'ordinari':158C 'path':185C 'per':107C 'per-namespac':106C 'privileg':154C 'process':169C,194C 'read':153C,159C 'real':147C 'reclaim':189C 'referenc':161C 'remov':140C 'repeat':156C 'request':127C 'restart':192C 'retain':171C 'server':98C,168C 'slow':179C 'statist':109C 'steadili':172C 'suppli':124C 'tabl':104C 'user':150C 'way':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120820","severity":null,"published_at":"2026-11-10T21:19:00+00:00","modified_at":"2026-11-10T21:19:00+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}