# CVE-2026-118383: Use-after-free vulnerability in MongoDB Server (replica set primary catch-up)

> A use-after-free in MongoDB Server replica set members (including shard and config server replica sets) can be planted remotely and without authentication via two ping requests carrying a readConcern.afterOpTime value, then crashes the member when a lagging node wins an election and finishes primary catch-up. Datadog reproduced a segmentation fault on 8.0.34 but did not demonstrate code execution; MongoDB was not aware of exploitation when it announced fixes on November 10, 2026.

- **Published:** 2026-11-11T23:09:18Z
- **Last reviewed:** 2026-11-12T09:59:22.777Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5803
- **ID:** TL-2026-5803
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (1 shown free below)
- **CVEs:** CVE-2026-118383

## Description

CVE-2026-118383 (GHSA-fjxh-6vgh-cx2c, CWE-416) is a use-after-free in MongoDB Server's primary catch-up logic. MongoDB found the issue internally through its proactive security program and published fixes on November 10, 2026. The CVSS v4.0 base score is 9.5 (Critical), vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The vendor describes the impact as potentially unauthorized access to the MongoDB Server. Datadog Security Labs published its analysis on November 11, 2026.

Exploit mechanics (per Datadog): in a first stage, an attacker sends two unauthenticated ping requests carrying a readConcern.afterOpTime value to a reachable, vulnerable replica set member. The ping command is accepted before authentication, so enabling authentication does not prevent it. The requests plant stale 'waiters' (pending notifications created for requests that wait for a replication point). These persist until the member restarts, rolls back, or steps down from primary. In a second stage, when that member wins an election while lagging behind another member, the end-of-catch-up cleanup runs twice, uses memory that has already been freed, and crashes the process before the member accepts writes. The backtrace points to CatchupState::abort_inlock(). The attacker cannot cause the lag or the election, which is why the CVSS attack complexity is High. In Datadog's lab the crash took about 40 seconds, but the authors induced the lag and failover themselves, so this is not a real-world estimate.

Impact: a reproduced segmentation fault (denial of service, and a repeated crash on the newly elected primary can disrupt failover and availability of the replica set or shard). Code execution in the server process is described as possible under certain conditions but was not demonstrated. No public PoC was identified, no exploitation was known to MongoDB as of the November 10 announcement, and there is no attribution to any actor. Standalone mongod instances are not affected. Datadog confirmed 8.0.34 vulnerable and found that 8.0.37 rejected the unauthenticated requests.

Detection (log-based, from Datadog): COMMAND 'Slow query' event ID 51803 showing a ping with an unusual readConcern.afterOpTime and a MaxTimeMSExpired errName; primary catch-up entry ID 21359, followed by two catch-up exits ID 21363 within one transition; then a fatal signal or backtrace in CatchupState::abort_inlock(). Log settings may omit the command object, and attr.remote may show a loopback address, so logs from before the failover should be reviewed. There are no network or file IOCs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.005 Obtain Capabilities
- T1588.006 Obtain Capabilities
- T1499 Endpoint Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-118383 MongoDB Primary Catch-Up Double Exit and CatchupState::abort_inlock Crash** (`TL-2026-5803-SPL-002`)

Detects the second stage of CVE-2026-118383: a replica set member that logs two primary catch-up exits (event ID 21363) in one 5-minute window, or a fatal backtrace containing CatchupState::abort_inlock(), after entering primary catch-up (event ID 21359). A single catch-up exit is normal; two within one transition followed by a fatal signal is the use-after-free crash sequence, an application-exploitation endpoint denial of service.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1499.004, T1499, T1190
- **Data sources:** mongod structured JSON log (mongod.log), splunk index=mongodb sourcetype=mongod, sentinel Syslog table (ProcessName=mongod)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=mongodb sourcetype=mongod earliest=-24h ("\"id\":21359" OR "\"id\":21363" OR "CatchupState::abort_inlock")
| spath path=id output=log_id
| eval catchup_entered=if(log_id=21359,1,0), catchup_exit=if(log_id=21363,1,0), fatal_abort_inlock=if(match(_raw,"CatchupState::abort_inlock"),1,0)
| bin _time span=5m
| stats sum(catchup_entered) AS catchup_entries sum(catchup_exit) AS catchup_exits sum(fatal_abort_inlock) AS fatal_events BY host _time
| where catchup_exits>=2 OR fatal_events>0
| convert ctime(_time)
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where ProcessName =~ "mongod" and SyslogMessage has_any ("21359", "21363", "CatchupState::abort_inlock")
| extend Payload = parse_json(extract(@"(\{.*\})", 1, SyslogMessage))
| extend LogId = tostring(Payload.id)
| where LogId in ("21359", "21363") or SyslogMessage has "CatchupState::abort_inlock"
| summarize CatchupEntries = countif(LogId == "21359"), CatchupExits = countif(LogId == "21363"), FatalEvents = countif(SyslogMessage has "CatchupState::abort_inlock") by Computer, bin(TimeGenerated, 5m)
| where CatchupExits >= 2 or FatalEvents > 0
| project TimeGenerated, Computer, CatchupEntries, CatchupExits, FatalEvents
```

### Sigma

```yaml
title: CVE-2026-118383 MongoDB Fatal Backtrace In CatchupState::abort_inlock After Catch-Up
id: 6e2a94d7-1b35-4c80-a7f3-92d1e8c5b602
status: experimental
description: Detects a mongod fatal signal backtrace referencing CatchupState::abort_inlock(), the crash location for the CVE-2026-118383 use-after-free during primary catch-up.
references:
    - https://securitylabs.datadoghq.com/articles/cve-2026-118383-mongodb-server-use-after-free/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-118383
    - https://github.com/advisories/GHSA-fjxh-6vgh-cx2c
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.impact
    - attack.t1499
    - attack.t1499.004
    - attack.initial-access
    - attack.t1190
    - cve.2026.118383
logsource:
    product: mongodb
    service: mongod
detection:
    keywords:
        - 'CatchupState::abort_inlock'
    condition: keywords
falsepositives:
    - None expected; the symbol only appears in catch-up crash or assertion backtraces
level: high

```

**Known false positives:**

- Two catch-up exits in one 5-minute bin during two genuine back-to-back elections in an unstable cluster
- Crashes in CatchupState::abort_inlock caused by unrelated bugs on already-patched versions

**Tuning notes:** Correlate hits with a prior ping/afterOpTime planting alert (SPL-001) and the running version. Tighten span to 1m if elections are frequent. Ensure mongod.log is forwarded after a process crash (flush on restart) so fatal backtraces are not lost.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-118383 MongoDB Unauthenticated afterOpTime Ping From Non-Internal Source (locked: unlock with TL Creds)
- CVE-2026-118383 MongoDB abort_inlock Crash Followed By mongod Restart (locked: unlock with TL Creds)
- CVE-2026-118383 MongoDB Planting Request Followed By Primary Catch-Up on Same Member (locked: unlock with TL Creds)
- CVE-2026-118383 MongoDB Slow ping afterOpTime MaxTimeMSExpired Event (locked: unlock with TL Creds)
- CVE-2026-118383 Post-Exploitation Hunt: mongod Spawning Shell or Download Utility (locked: unlock with TL Creds)
- CVE-2026-118383 MongoDB Server Started On Vulnerable Build (Exposure) (locked: unlock with TL Creds)
- CVE-2026-118383 MongoDB Unauthenticated ping with readConcern.afterOpTime (Waiter Planting) (locked: unlock with TL Creds)
- CVE-2026-118383 MongoDB Replica Set Member Sweep With afterOpTime Ping Requests (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 12)

Defanged, TLP:CLEAR.

- URL: `hxxps://github[.]com/googlesky/CVE-2026-118383`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CVE-2026-118383: Use-after-free vulnerability in MongoDB (Datadog Security Labs)](https://securitylabs.datadoghq.com/articles/cve-2026-118383-mongodb-server-use-after-free/)
- [GitHub Advisory GHSA-fjxh-6vgh-cx2c](https://github.com/advisories/GHSA-fjxh-6vgh-cx2c)
- [NVD: CVE-2026-118383](https://nvd.nist.gov/vuln/detail/CVE-2026-118383)
- [Important MongoDB Security Update Available - Action Required (November 10, 2026)](https://www.mongodb.com/community/forums/t/important-mongodb-security-update-available-action-required-november-10-2026/344843)
- [MongoDB JIRA SERVER-138119](https://jira.mongodb.org/browse/SERVER-138119)
- [MongoDB JIRA SERVER-138175](https://jira.mongodb.org/browse/SERVER-138175)
- [MongoDB Log Messages reference (v8.0)](https://www.mongodb.com/docs/v8.0/reference/log-messages/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5803