# CVE-2026-96297: MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline

> CVE-2026-96297: MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-96297
Last updated: 2026-10-15T20:38:04Z

- Published: 2026-10-13 15:23 UTC · Updated: 2026-10-15 20:38 UTC · Assigner: mongodb
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.24%, 15th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-416

## Description

Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.

## Affected vendors and products

- MongoDB: MongoDB Server

## Tracked companies

- [MongoDB Atlas](https://rewindex.com/company/mongodb-atlas.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-96297)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-96297)
- [https://jira.mongodb.org/browse/SERVER-132946](https://jira.mongodb.org/browse/SERVER-132946)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-96297 · Markdown: https://rewindex.com/cve/CVE-2026-96297.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-96297 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:08.118Z