---
title: CVE-2026-96297
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2026-96297
---

# CVE-2026-96297

Publication date 13 October 2026

Last updated 14 October 2026

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**6.5 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2026-96297#impact-score)

Toggle side navigation

## Description

Use of freed memory in the aggregation feature of MongoDB Server can cause
the server to read data from a memory area after it has been released. When
an internal aggregation stage is combined with a batch size of 0, the
server may read from memory that is no longer in use. Because that memory
can be reused for other data before it is read, query results returned to
the client may contain unrelated data from the server process. Depending on
the state of memory at the time, the server process may also terminate
unexpectedly. The behavior can occur when an authenticated user with read
privileges runs an aggregate command that combines these two settings.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| mongodb | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release |
| 22.04 LTS jammy | Not in release |
| 20.04 LTS focal | Needs evaluation |
| 18.04 LTS bionic | Needs evaluation |
| 16.04 LTS xenial | Needs evaluation |
| 14.04 LTS trusty | Needs evaluation |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:

CVSS v4.0

[CVSS v4.0](https://ubuntu.com/security/CVE-2026-96297)
[CVSS v3.0](https://ubuntu.com/security/CVE-2026-96297)

**Base score**

6.0 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Attack requirements | Present |
  | Privileges required | Low |
  | User interaction | None |
  | Vulnerable system - Confidentiality impact | High |
  | Vulnerable system - Integrity impact | None |
  | Vulnerable system - Availability impact | None |
  | Subsequent system - Confidentiality impact | None |
  | Subsequent system - Integrity impact | None |
  | Subsequent system - Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 6.0 · Medium |
  | Base + Threat score | - |
  | Base + Environmental score | - |
  | Base + Threat + Environmental score | - |

**Vector:** CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96297)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-96297)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-96297)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2026-96297)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2026-96297>
* <https://jira.mongodb.org/browse/SERVER-132946>