CVE-2026-82055

A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.

• CWE-476

• https://jira.mongodb.org/browse/SERVER-130202Vendor Advisory, Issue Tracking

Published

Sep 8, 2026

Last Modified

Sep 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82045UTMStack before 11.2.16 contains a JPQL injection vulnerabil…6.5
• CVE-2026-82049In CPython 3.13 and earlier, the tarfile module's data and t…8.4
• CVE-2026-8205Concrete CMS 9.5.0 and below is vulnerable to authorization …5.3
• CVE-2026-82052The $regexFindAll expression can be used by an authenticated…6.5
• CVE-2026-82053A security issue exists in MongoDB's LDAP authorization inte…8.1
• CVE-2026-82054A security issue exists in MongoDB server's JSON Pointer par…6.5
• CVE-2026-82056A race condition in MongoDB server's text index query parsin…5.3
• CVE-2026-82057A security issue was discovered in MongoDB where an authenti…6.5
• CVE-2026-82058A flaw in MongoDB's JSON Schema validation error generation …6.5
• CVE-2026-82059An internal aggregation expression in MongoDB Server was inc…6.5
• CVE-2026-8206The Kirki – Freeform Page Builder, Website Builder & Customi…9.8
• CVE-2026-82060In MongoDB, insufficient validation of shard key values duri…5.4