CVE WatchSep 8, 2026

CVE-2026-82075

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client th

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-770

EPSS · 30d

Not enough EPSS history yet.

Technical description

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.

Official references

jira.mongodb.orghttps://jira.mongodb.org/browse/SERVER-132650

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-729785.9 MED

—

———Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.5h CVE-2026-693746.5 MED

—

———Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network.5h CVE-2026-570997.5 HIG

—

———Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.5h CVE-2026-820546.5 MED

—

———A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.5h CVE-2026-626497.5 HIG

—

——0A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. This could allow an unauthenticated remote attacker to cause the entire device to crash and reboot, resulting in a denial-of-service condition.5h CVE-2026-488887.5 HIG

—

——0Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.10h