Critical CVE-2026-118383 Affects MongoDB Server, Patches Available

## Overview CVE-2026-118383 is a critical vulnerability affecting MongoDB Server. It scores 9.5 on the CVSS scale. The issue arises in the replication component during the catch-up process of newly elected primary replica set members. This vulnerability can be triggered by unauthenticated requests. ## Technical Details The use-after-free condition occurs when a primary replica set completes its catch-up process. This can lead to unexpected server termination or, in some cases, arbitrary code execution within the server process. Affected components include replica set members, shard members, and config server replica set members in sharded clusters. Standalone mongod instances are not impacted. ## Impact If exploited, this vulnerability can allow attackers to crash database servers with minimal effort, such as sending just two ping requests. This poses a significant risk during failover scenarios, potentially leading to service disruptions and data loss. ## Mitigation Defenders should prioritize applying the patches released by MongoDB to address CVE-2026-118383. It is crucial to monitor systems for any signs of exploitation and ensure that all instances of MongoDB Server are updated to the latest version.