Percona Server for MongoDB 8.3.7-1 (2026-07-30)¶

Technical Preview

Percona Server for MongoDB 8.3.7-1 is available as a technical preview.

We recommend that early adopters use this release for testing purposes only and not in production environments.

We are pleased to announce the new major version of Percona Server for MongoDB 8.3.7-1 – the drop-in replacement for MongoDB Community Edition. Percona Server for MongoDB supports MongoDB Community protocols and drivers and enhances it with the enterprise-grade features for free, enabling you to effectively meet the requirements of your organization in terms of high-availability, reliability and data security.

This release of Percona Server for MongoDB includes the improvements and bug fixes of MongoDB 8.3.7 Community Edition .

Upgrade considerations¶

To upgrade to Percona Server for MongoDB 8.3 from an 8.0 deployment, the deployment must have featureCompatibilityVersion set to 8.0.

'db.adminCommand({ setFeatureCompatibilityVersion: "8.0", confirm: true })'
{ ok: 1 }

'db.adminCommand({ getParameter: 1, featureCompatibilityVersion: 1 })'
{ featureCompatibilityVersion: { version: '8.0' }, ok: 1 }

For detailed upgrade instructions, see Upgrade from Percona Server for MongoDB 8.0.

Release Highlights¶

Software Bill of Materials (SBOM) and Vulnerability Exploitability Exchange (VEX)¶

Percona Server for MongoDB (PSMDB) now provides Software Bills of Materials (SBOMs) and Vulnerability Exploitability Exchange (VEX) for every release. SBOMs improve software supply chain transparency by documenting the components and dependencies included in a build. They are generated automatically as part of the release pipeline in the industry standard CycloneDX format. Additionally, to help users filter out false-positive alerts, we’ve published VEX files that clearly indicate whether and how Percona Server for MongoDB is affected by specific CVEs reported by an SBOM scanner.

SBOMs are distributed through the following channels:

Tarballs: An SBOM is included in doc/sbom.cdx.json file.
Packages: For .deb and .rpm packages, the SBOM file is installed in a standard documentation directory such as /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json.
Docker: The SBOM is attached directly to the Docker image as metadata.

OpenVEX files are available to download via GitHub Pages. You can always find the main openvex.json file with the latest vulnerability exploitability status, along with a dedicated OpenVEX file for each release, formatted https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-<VERSION>.openvex.json. This release 8.3.7-1 is available at: https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-8.3.7-1.openvex.json.

For comprehensive information, refer to our documentation.

Upstream improvements¶

The key upstream improvements include:

Aggregation and search¶

The $scoreFusion aggregation stage is now available, and new expressions support hashing, Extended JSON conversion, binary subtypes, and ObjectId generation.
The $map,$filter, and $reduce expressions can access array element indexes. This release also expands conversions between BSON types, strings, arrays, objects, numeric values, and Extended JSON.

Monitoring and diagnostics¶

Full-time diagnostic data capture (FTDC) collects connection pool statistics for mongod. The serverStatus output includes additional metrics for query planning, replication, TTL processing, search operations, and execution queues.

Resource management¶

Text search operations that process text score metadata have a 100 MB memory limit. When allowDiskUse is enabled, intermediate results can spill to disk. New controls also limit memory consumption from pre-authentication connections and improve retry behavior during high load.

Shard removal¶

The removeShard command is deprecated in favor of commands that provide more control over shard draining and removal. New commands let administrators start, stop, monitor, and complete shard draining as separate operations.

Indexes and time series collections¶

2dsphere index version 4 is introduced as the default and changed how geospatial indexes handle documents containing both GeoJSON and legacy coordinates. It also adds validation and naming restrictions for time series collections.

For the complete list of upstream changes, see Release Notes for MongoDB 8.3 and Compatibility Changes in MongoDB 8.3 .

Other improvements include the following:

SERVER-83322 : Improved query planning for compound wildcard indexes. Filters on fields outside the index no longer cause the bounds for indexed fields to revert to [MinKey, MaxKey], allowing queries to use more selective index bounds.
SERVER-108215 : Added a limit to the number of concurrent open multi-document transactions. When the limit is reached, MongoDB rejects new transactions, preventing large numbers of idle transactions from consuming excessive resources.
SERVER-127346 : Improved session refresh and cleanup during heavy workloads. These tasks now bypass busy queues, preventing delays and errors.

Security fixes from upstream MongoDB¶

This release fixes vulnerabilities inherited from upstream MongoDB. The severity categories below follow the upstream CVSS scores .

Critical severity¶

SERVER-128494 (CVE-2026-13072 ): Fixed an issue where compute mode on a standalone MongoDB instance could cause memory corruption while processing externally sourced BSON data in an aggregation pipeline. This could cause the process to terminate or behave unexpectedly. Compute mode is disabled by default and must be enabled explicitly at startup.

High severity¶

SERVER-123081 (CVE-2026-13055 ): Fixed an issue in the $_internalIndexKey aggregation expression. An authenticated user with permission to run aggregation pipelines could submit a compound wildcard index specification that caused mongod to stop, resulting in a denial-of-service attack.
SERVER-124355 (CVE-2026-13056 ): Improved memory checks for array expressions. Previously, a query using $concatArrays and $range could consume all available memory and cause mongod to stop.
SERVER-125872 (CVE-2026-13064 ): Fixed an issue where deeply nested $jsonSchema queries could consume excessive CPU during query planning. This could slow down the server and result in a denial-of-service.
SERVER-127280 (CVE-2026-13065 ): Fixed an input validation issue in $linearFill. A user with read-only access could provide an unsupported expression in sortBy, causing mongod to stop and resulting in a denial-of-service.
SERVER-127357 (CVE-2026-13060 ): Fixed an issue in the $graphLookup aggregation stage that could allow an authenticated user with limited read permissions to access documents from restricted collections. This could occur when the collections were referenced in an existing view pipeline.
SERVER-127566 (CVE-2026-13069 ): Added a limit for the contention value used with Queryable Encryption (FLE2). Previously, an authenticated user could submit a request with a very high value, consuming excessive CPU or memory and making the server slow or unresponsive.
SERVER-127661 (CVE-2026-13058 ): Fixed an issue where an authenticated user with write access could send an incomplete transaction command and cause mongod to stop, resulting in a denial-of-service.
SERVER-127694 (CVE-2026-13066 ): Resolved an issue where improper handling of DBPointer objects during BSON serialization in the server-side JavaScript engine could expose internal memory contents to the client. This information disclosure vulnerability affected deployments that use server-side JavaScript.
SERVER-127831 (CVE-2026-13062 ): Resolved an issue where an authenticated user with write privileges on a collection that supports Queryable Encryption could modify internal encryption metadata fields, which are intended to be controlled by the server. This was achieved by sending crafted write commands through the mongos router in a sharded cluster. As a result, this could lead to incorrectly encrypted queries.
SERVER-128316 (CVE-2026-13075 ): Resolved an issue that allowed an authenticated user to terminate the mongod process due to memory pressure when using the $rankFusion and $scoreFusion aggregation stages. This problem stems from the server’s error-handling path and requires the user to have the ability to run aggregation queries.
SERVER-128341 (CVE-2026-9737 ): Corrected an issue in query planning where reading the sort pattern in raw BSONObj form did not explicitly handle the meta-expression case. This omission could lead to incorrect transformations and potentially cause invariant failures.
SERVER-128387 (CVE-2026-13067 ): Fixed an issue where roles from X.509 client certificates were not always checked against the tlsCATrusts allow list when PROXY protocol v2 was used over a Unix domain socket. This could grant unintended roles after MONGODB-X509 authentication.
SERVER-128433 (CVE-2026-13059 ): Resolved an issue where an authenticated user with limited privileges could bypass role-based query-level access controls by submitting specially crafted command parameters. This could allow unauthorized read or write operations through the find, update, delete, and aggregate commands when strict API rules were not enforced.
SERVER-128473 (CVE-2026-13071 ): Resolved an issue where an authenticated user with read access could terminate the mongod process using certain aggregation expressions that execute server-side JavaScript. This issue was caused by improper memory handling during document processing.
SERVER-128584 (CVE-2026-13076 ): Resolved an issue where an authenticated user with write access could trigger excessive memory consumption through a specific aggregation data type conversion. Under memory pressure, this could cause the operating system to terminate the mongod process.
SERVER-129103 (CVE-2026-13077 ): Fixed an issue where MongoDB did not properly validate CodeWScope elements in malformed BSONColumn data. An authenticated user could exploit this with a crafted aggregation pipeline, causing mongod to stop or expose nearby process memory.

Medium severity¶

SERVER-126247 (CVE-2026-13057 ): Fixed an issue where the internal mergingPipeline field in search queries was not properly validated.
SERVER-127689 (CVE-2026-13061 ): Fixed an issue in the $listSessions aggregation stage that could expose session information to users without the required cluster-level privileges. An authenticated user could view other users’ session IDs, usernames, and activity timestamps.
SERVER-127737 (CVE-2026-13063 ): Resolved an issue where an authenticated user with standard read/write privileges could crash mongod by sending a crafted aggregation command. Insufficient validation of payload values in libmongocrypt could cause excessive memory allocation, resulting in an out-of-memory condition.
SERVER-128362 (CVE-2026-13070 ): Resolved an issue where a MongoDB server could terminate unexpectedly while processing a malformed OCSP response during an outbound TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Exploitation required either a remote peer with a certificate issued by the cluster’s trusted certificate authority or a connection passing through an untrusted network path.
SERVER-128517 (CVE-2026-13074 ): Fixed an issue where pre-authentication hello requests in exhaust mode accepted very small maxAwaitTimeMS values. An unauthenticated client could use this behavior to create a tight response loop that consumed excessive CPU and reduced server availability.
SERVER-128832 (CVE-2026-13078 ): Fixed an issue discovered in MongoDB Server, where the server-side MozJS scripting engine unconditionally registered a module-loading hook that enables JavaScript to read arbitrary files from the host filesystem using the mongod process’s privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

For the complete upstream changelog, see MongoDB 8.3.7 Community Edition .

Changelog¶

New features¶

PSMDB-2150: Percona Server for MongoDB (PSMDB) now provides Software Bills of Materials (SBOMs) for every release.
PSMDB-2003: Added caching of LDAP userToDNMapping to reduce the number of round-trips to the LDAP server during authentication and authorization. Caching is controlled by security.ldap.userToDNMapping (exposed as --ldapUserToDNMapping at startup and ldapUserToDNMapping at runtime). For detailed information, see our documentation.
PSMDB-2038: Percona Server for MongoDB now exposes LDAP userToDN cache statistics through the serverStatus command. These metrics provide visibility into cache utilization and effectiveness, helping administrators troubleshoot LDAP authentication latency, validate cache behavior after configuration changes, and optimize cache sizing for their workloads. The new ldap.userToDNCache section reports runtime information such as cache usage, hits, misses, and invalidations, making LDAP authentication performance easier to monitor and tune.

Tools packaged with this release¶

Percona Server for MongoDB packages the following MongoDB tools:

MongoDB Shell (mongosh): 2.9.2 — upstream release notes