---
id: "CVE-2026-120820"
page: "https://infrastack.ai/live/CVE-2026-120820"
kind: "vulnerability"
aliases: ["CVE-2026-120820"]
title: "MongoDB Server: unbounded memory growth from arbitrary namespace names in reads"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["database", "infrastructure", "mongodb", "self-hosted"]
not_affected_if: ["no-untrusted-read-users"]
published_at: "2026-11-10T21:19:00+00:00"
first_seen_at: "2026-11-10T21:46:14+00:00"
updated_at: "2026-11-10T21:49:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120820", "first_seen_at": "2026-11-10T21:46:14+00:00"}]
exploit_sources: []
---

# MongoDB Server: unbounded memory growth from arbitrary namespace names in reads

Link for people: https://infrastack.ai/live/CVE-2026-120820 (this .md is for agents)

MongoDB Server keeps an in-memory table of per-namespace statistics for operations with encrypted-field information and adds an entry for every namespace named in a request, with no limit and no way to remove stale ones. A user with basic read privileges can send repeated read commands with made-up namespace names, causing the server process to grow in memory and slow down until it is restarted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the MongoDB Server version with `mongod --version` and compare it against the fixed versions below

## Timeline

- 2026-11-10T21:46:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120820

## From the sources

MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_