Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time.
This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Mongodb | — | Upgrade MongoDB to version 8.3.2Upgrade MongoDB to version 8.0.23Upgrade MongoDB to version 8.2.9Upgrade MongoDB to version 7.0.34Upgrade to the latest version of MongoDB | May 21, 2026 | May 13, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.4.1Upgrade Splunk Enterprise to version 9.4.13Upgrade Splunk Enterprise to version 10.2.5Upgrade Splunk Enterprise to version 10.0.8 | Jul 30, 2026 | May 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub