Skip to content
Percona Software for MongoDB Documentation
Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona Server for MongoDB 8.3.8-2 (2026-08-24)

Installation Upgrade

Technical Preview

Percona Server for MongoDB 8.3.8-2 is available as a technical preview.

We recommend that early adopters use this release for testing purposes only and not in production environments.

We are pleased to announce Percona Server for MongoDB 8.3.8-2 – the drop-in replacement for MongoDB Community Edition. Percona Server for MongoDB supports MongoDB Community protocols and drivers and enhances it with the enterprise-grade features for free, enabling you to effectively meet the requirements of your organization in terms of high-availability, reliability and data security.

This release of Percona Server for MongoDB includes the improvements and bug fixes of MongoDB 8.3.8 Community Edition .

Upgrade recommendation

This release fixes one critical and several high-severity vulnerabilities inherited from upstream MongoDB. We recommend upgrading to version 8.3.8-2 as soon as possible.

Upgrade considerations

To upgrade to Percona Server for MongoDB 8.3 from an 8.0 deployment, the deployment must have featureCompatibilityVersion set to 8.0.

'db.adminCommand({ setFeatureCompatibilityVersion: "8.0", confirm: true })'
{ ok: 1 }

'db.adminCommand({ getParameter: 1, featureCompatibilityVersion: 1 })'
{ featureCompatibilityVersion: { version: '8.0' }, ok: 1 }

For detailed upgrade instructions, see Upgrade from Percona Server for MongoDB 8.0.

Release Highlights

Extended platform support: RHEL 10 and its derivatives, and Debian 13

Percona Server for MongoDB 8.3.8-2 adds packages for new platforms, including RHEL 10 and its derivatives, and Debian 13.

Platform Derivative of Architecture
RHEL 10 — x86_64, ARM64
Rocky Linux 10 RHEL 10 x86_64, ARM64
AlmaLinux 10 RHEL 10 x86_64, ARM64
Oracle Linux 10 (RHCK only) RHEL 10 x86_64, ARM64
Debian 13 (Trixie) — x86_64, ARM64

Info

You can install Percona Server for MongoDB 8.3.8-2 on Debian 13. Although upstream MongoDB does not yet list Debian 13 as a supported platform, Percona builds and tests these packages independently, making them available ahead of upstream support.

Changelog

New features

  • PSMDB-2197: Added RHEL 10 build support for Percona Server for MongoDB (PSMDB) 8.3.x.

  • PSMDB-2173: Added Debian 13 x86_64 build support for Percona Server for MongoDB (PSMDB) 8.3.x.

  • PSMDB-2198: Added Debian 13 ARM64 build support for Percona Server for MongoDB (PSMDB) 8.3.x.

Security fixes from upstream MongoDB

This release fixes vulnerabilities inherited from upstream MongoDB. The severity categories below follow the upstream CVSS scores .

Critical severity

  • SERVER-130264 (CVE-2026-18691 ): Fixed an issue in intra-cluster authentication where an attacker with access to cluster network traffic could influence the authentication mechanism used between replica set members. Under certain conditions, this could expose the cluster’s shared internal credential in a less-protected form. An attacker who recovered this credential could use it to authenticate to nodes with internal superuser privileges.

High severity

  • SERVER-130628 (CVE-2026-18687 ): Fixed an issue in Queryable Encryption maintenance operations where an authenticated user with readWrite privileges could submit a specially crafted request that was not properly validated against the collection’s encrypted field configuration. This could crash the server process, cause excessive internal writes, or corrupt encrypted index data.

  • SERVER-129617 (CVE-2026-18688 ): Fixed an issue in MongoDB Server’s aggregation framework where an authenticated user could trigger an out-of-bounds memory read by supplying a specially crafted numeric value to an aggregation pipeline stage. This could crash the server or expose a limited amount of process memory.

  • SERVER-130481 (CVE-2026-18690 , CVE-2026-18698 ): Fixed an issue where an authenticated user with limited database-level privileges could perform operations on protected system collections without the required permissions. This could allow critical system collections to be dropped and recreated.

  • SERVER-129887 (CVE-2026-18692 ): Fixed a memory handling error in time series bucket lifecycle management where an authenticated user with write privileges could leave the server holding a reference to memory that had already been released. Later operations against the affected bucket could crash the server process or, in some cases, run unintended code.

  • SERVER-129994 (CVE-2026-18693 ): Fixed an issue with time series collections where an authenticated user with write access could insert documents that left an internal data structure in an inconsistent state. A later insert into the affected bucket could crash the server process, expose a limited amount of process memory, or corrupt memory.

  • SERVER-130188 (CVE-2026-18694 ): Fixed an issue in geospatial query processing where an authenticated user with write access could store malformed geometry data that the server later processed without proper validation. A query against the affected data could crash the server process or expose a limited amount of process memory.

  • SERVER-129460 (CVE-2026-18695 ): Fixed an issue in the processing of query predicates on time series collections with a metaField, where an authenticated user with write access could terminate the server process, resulting in a denial-of-service.

  • SERVER-130139 (CVE-2026-18696 ): Fixed an issue in the applyOps command where the namespace used for the permission check could differ from the namespace used by the operation. An authenticated user with certain non-default privileges could drop or modify collections outside their permissions.

  • SERVER-130110 (CVE-2026-18697 ): Fixed an issue in the aggregation framework where an unauthenticated user could crash a mongos process by sending a specially crafted aggregation command. This could cause a denial-of-service and interrupt client connections routed through the affected instance. This affects sharded clusters only.

  • SERVER-130111 (CVE-2026-18701 ): Fixed an issue in query processing where a user with read privileges could terminate mongod with a specially crafted query filter, resulting in a denial-of-service.

  • SERVER-129936 (CVE-2026-18704 ): Fixed an authorization issue in the aggregation framework where an authenticated user with read privileges could reach an internal aggregation stage and perform write operations without the required permissions.

  • SERVER-128551 (CVE-2026-18706 ): Fixed an issue in the $graphLookup aggregation stage where an authenticated user with permissions to run aggregation and memory-management commands could trigger invalid memory access. This could crash the server and, in some cases, lead to unintended code execution.

  • SERVER-128482 (CVE-2026-18707 ): Fixed an issue in the aggregation framework where an authenticated user could crash the server process with a specially crafted aggregation command, resulting in a denial-of-service. No specific privileges were required beyond a valid login.

  • SERVER-130247 (CVE-2026-18711 ): Fixed an issue in the query execution engine where an authenticated user with read and write privileges could run a query against a time series collection that left the server referencing memory already released. This could crash the server process or return freed memory contents in query results.

  • SERVER-130633 (CVE-2026-18712 ): Fixed an authorization issue in Queryable Encryption maintenance operations where a user with privileges on one encrypted collection could modify or delete data in another collection.

Medium severity

  • SERVER-130266 (CVE-2026-18699 ): Fixed an issue in the query planner where a user with read privileges could terminate the server with a specially crafted query against a collection with a text index. This could result in a denial-of-service.

  • SERVER-130117 (CVE-2026-18700 ): Fixed an issue in geospatial validation where concurrent operations by an authenticated user with write privileges against a collection using an affected validator could cause invalid memory access and crash the server, resulting in a denial-of-service.

  • SERVER-130198 (CVE-2026-18702 ): Fixed an issue where a user with limited database-scoped privileges could change diagnostic logging settings for the entire server. This could suppress diagnostic logging or generate excessive log output.

  • SERVER-130167 (CVE-2026-18708 ): Fixed an issue in the JavaScript scripting engine where an authenticated user with write privileges could influence query execution for other users through a specially crafted stored value processed during internal maintenance. This could return incorrect query results or cause a denial-of-service for operations on the same database. The issue is confined to the scripting engine sandbox and does not grant access to filesystem or network resources.

  • SERVER-130544 (CVE-2026-18709 ): Fixed an issue in sharded clusters where a user with direct network access to a shard could commit or abort a prepared transaction without going through the expected transaction coordination process. This could cause cross-shard data inconsistencies, affect the cluster clock, and violate transaction atomicity.

For the complete upstream changelog, see MongoDB 8.3.2 Community Edition .

Tools packaged with this release

Tool Base version Release notes
MongoDB Shell (mongosh) 2.10.0 upstream release notes
Mongo Tools 100.18.0 upstream release notes