HIGH
Stack memory disclosure in filemd5 command
Published Mar 17, 2026
7.1
HIGHCVSS 4.0
EPSS 0.36%
Description
An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command.
Affected products
-
- Version 7.0StatusaffectedConstraints<7.0.31
- Version 8.0StatusaffectedConstraints<8.0.20
- Version 8.2StatusaffectedConstraints<8.2.6
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MongoDB Inc | MongoDB Server | unaffected |
|
OR
- ≥ 7.0.0 · < 7.0.31
- ≥ 8.0.0 · < 8.0.20
- ≥ 8.2.0 · < 8.2.6
- 8.3.0
- 8.3.0
- 8.3.0
- 8.3.0
- 8.3.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12586 Advisory
- https://jira.mongodb.org/browse/SERVER-119317 PatchVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-12586 | Advisory | |
| https://jira.mongodb.org/browse/SERVER-119317 | PatchVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mongodb
Published Mar 17, 2026
Updated Mar 17, 2026
Reserved Mar 13, 2026
Link CVE-2026-4147
CISA Vulnrichment
Updated Mar 17, 2026
ENISA EUVD
EUVD-2026-12586 Assigner mongodb
Published Mar 17, 2026
Updated Mar 17, 2026
Exploited since n/a
Link EUVD-2026-12586