Skip to content
Percona Software for MongoDB Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona Server for MongoDB 8.0.32-14 (2026-09-23)

Installation Upgrade from MongoDB Community

Percona Server for MongoDB 8.0.32-14 is an enhanced, source-available, and highly scalable database that is a fully compatible, drop-in replacement for MongoDB Community Edition.

Percona Server for MongoDB 8.0.32-14 includes the improvements and bug fixes of:

Upgrade recommendation

This release fixes multiple security vulnerabilities inherited from upstream MongoDB. We strongly recommend upgrading to version 8.0.32-14 as soon as possible.

Changelog

Improvement

Bugs fixed

  • PSMDB-2253: Fixed an issue that caused a replica set member to crash during file-copy-based initial sync when KMIP encryption at rest was enabled. The crash occurred when the member started with an empty data directory and no --kmipKeyIdentifier. In this case, the member generated a new KMIP master key but could not use it to decrypt the key.db/ files copied from the sync source.

Security fixes from upstream MongoDB

The severity categories below follow the upstream CVSS scores .

Critical severity

  • SERVER-131229 (CVE-2026-82067 ): Fixed an issue in MongoDB Server’s configuration validation where incorrect handling of case sensitivity could leave authorization disabled during startup. If this occurred, an unauthenticated user with network access could perform administrative operations without authorization, potentially compromising data confidentiality, integrity, and availability.

High severity

  • SERVER-134063 (CVE-2026-89099 ): Fixed a race condition in the document value layer of MongoDB Server that allowed concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user with read-write privileges could trigger this condition over the normal client protocol. This could result in server termination and potential corruption of process memory with user-influenced content. This vulnerability could compromise the confidentiality, integrity, and availability of the affected server process.

  • SERVER-128253 (CVE-2026-82076 ): Fixed an integer overflow in the query planning component of MongoDB Server that allowed an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query caused the server to consume memory without bound during query planning, which exhausted the server process and caused a denial-of-service affecting all databases served by the affected node.

  • SERVER-132650 (CVE-2026-82075 ): Fixed uncontrolled resource consumption in the request-handling path of the MongoDB sharded-cluster router process. An unauthenticated client with network access to a router port could supply connection-monitoring parameters that caused the server to expend CPU resources without rate limiting, resulting in performance degradation or denial of service for legitimate clients.

  • SERVER-132275 (CVE-2026-82074 ): Fixed an authorization issue in the aggregation framework where $lookup accepted multiple pipeline arguments. This could allow an authenticated user to read collection data without the required authorization.

  • SERVER-131423 (CVE-2026-82070 ): Fixed inconsistent redaction in the MongoDB Server diagnostic reporting interface. This could expose protected credentials in diagnostic output to an authenticated user.

  • SERVER-131326 (CVE-2026-82068 ): Fixed an issue where crafted retryable write commands containing repeated statement IDs could trigger a fatal assertion. An authenticated user with write privileges could potentially crash the server.

  • SERVER-131420 (CVE-2026-82065 ): Fixed insufficient validation of user-supplied storage configuration options. An authenticated user could persist invalid metadata that prevented the server from operating normally, causing a persistent denial-of-service.

  • SERVER-130759 (CVE-2026-82064 ): Fixed an assertion failure in read concern processing on replica set members. An unauthenticated network client could trigger the failure and cause the server process to terminate.

  • SERVER-130926 (CVE-2026-82058 ): Fixed an issue in JSON Schema validation that could allow an authenticated user with readWrite privileges to crash mongod. A malformed array field name could trigger an unhandled exception while processing a $jsonSchema validation error, resulting in a denial-of-service.

  • SERVER-130901 (CVE-2026-82054 ): Fixed missing resource limits in the JSON Pointer parser used by $jsonSchema query filters. An authenticated user could submit crafted filters that amplified memory consumption and terminated mongod through resource exhaustion.

  • SERVER-130785 (CVE-2026-82053 ): Fixed an issue in MongoDB’s LDAP authorization integration where pooled LDAP connections could retain a previously authenticated identity under certain configurations. This could cause authorization checks to run with the wrong LDAP identity and assign roles that did not match the intended access policy. As a result, an authenticated user could receive privileges they were not meant to have.

  • SERVER-124077 (CVE-2026-82052 ): Fixed an issue in the $regexFindAll aggregation expression that could cause mongod to crash. Under certain conditions, a regular expression match could begin in the middle of a multi-code-unit character and trigger an assertion during query execution. An authenticated user with permission to run aggregation pipelines could trigger the issue, resulting in a denial of service.

Medium severity

  • SERVER-131562 (CVE-2026-82066 ): Fixed a heap out-of-bounds read in the query planning component. A crafted query could cause the server process to read memory beyond the allocated buffer boundaries.

  • SERVER-131870 (CVE-2026-82063 ): Fixed a use-after-free issue in cursor management that could cause the server to crash. Under certain conditions, cursor cleanup could access a resource after its memory had been freed. An authenticated user could trigger this condition, resulting in a denial-of-service attack.

  • SERVER-130571 (CVE-2026-82059 ): Fixed an internal aggregation expression that was incorrectly exposed to external clients. An authenticated user with read-only privileges could invoke it to trigger an assertion failure and cause a denial-of-service.

  • SERVER-130306 (CVE-2026-82056 ): Fixed a race condition in text index query parsing that could cause a heap use-after-free during concurrent text search and index management operations. An authenticated user with readWrite privileges could crash the server, causing denial-of-service.

For the complete upstream changelog, see MongoDB 8.0.32 Community Edition and MongoDB 8.0.30 Community Edition .

Tools packaged with this release

Tool Base version Release notes
MongoDB Shell (mongosh) 2.10.0 upstream release notes
Mongo Tools 100.18.0 upstream release notes