Medium · published September 8, 2026
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This
| Product | Versions | Fixed in |
|---|---|---|
| mongodb/mongodb | ≥ 7.0.0, < 7.0.41 | 7.0.41 |
| mongodb/mongodb | ≥ 8.0.0, < 8.0.30 | 8.0.30 |
| mongodb/mongodb | ≥ 8.3.0, < 8.3.9 | 8.3.9 |