{"id":9381,"date":"2026-06-26T18:18:28","date_gmt":"2026-06-26T21:18:28","guid":{"rendered":"https:\/\/executestep.com\/?p=9381"},"modified":"2026-06-29T10:19:29","modified_gmt":"2026-06-29T13:19:29","slug":"upgrade-percona-server-mongodb-8-0-26-11","status":"publish","type":"post","link":"https:\/\/executestep.com\/pt-br\/mongodb\/upgrade-percona-server-mongodb-8-0-26-11\/","title":{"rendered":"Upgrade Percona Server for MongoDB 8.0.23-10 para 8.0.26-11"},"content":{"rendered":"\n

A Percona publicou em 25\/06\/2026 a vers\u00e3o 8.0.26-11<\/strong> do Percona Server for MongoDB com recomenda\u00e7\u00e3o expl\u00edcita de atualiza\u00e7\u00e3o urgente devido a m\u00faltiplas vulnerabilidades de alta severidade.<\/p>\n\n\n\n

Este post documenta o upgrade realizado em lab: Replica Set de 3 n\u00f3s no Oracle Linux 8, sem downtime para a aplica\u00e7\u00e3o.<\/p>\n\n\n\n

Por que atualizar agora?<\/h2>\n\n\n\n

A vers\u00e3o 8.0.26-11 corrige 10 CVEs de severidade High e 1 Medium, todas afetando todas as vers\u00f5es 8.0.x anteriores.<\/p>\n\n\n\n

CVEs corrigidas<\/h3>\n\n\n\n
CVE<\/th>Severidade<\/th>Impacto<\/th><\/tr><\/thead>
CVE-2026-11933<\/td>High<\/td>Use-after-free no engine JS server-side ($where<\/code>, $function<\/code>) — information disclosure ou crash<\/td><\/tr>
CVE-2026-9740<\/td>High<\/td>BSON validator — DoS por input nao autenticado<\/strong><\/td><\/tr>
CVE-2026-9743<\/td>High<\/td>Aggregation framework — DoS via cursor malicioso<\/td><\/tr>
CVE-2026-9753<\/td>High<\/td>$_internalApplyOplogUpdate<\/code> — crash do servidor<\/td><\/tr>
CVE-2026-9752<\/td>High<\/td>Indice 2dsphere<\/code> — crash por documento crafted<\/td><\/tr>
CVE-2026-9750<\/td>High<\/td>Query execution — crash e resultados incorretos<\/td><\/tr>
CVE-2026-9749<\/td>High<\/td>$exchange<\/code> stage — crash em key-range partitioning<\/td><\/tr>
CVE-2026-9748<\/td>High<\/td>$_internalConvertBucketIndexStats<\/code> + $facet<\/code> — crash<\/td><\/tr>
CVE-2026-9747<\/td>High<\/td>fromRouter: true<\/code> + runtimeConstants.userRoles<\/code> — crash<\/td><\/tr>
CVE-2026-9746<\/td>High<\/td>$changeStream<\/code> + $_requestReshardingResumeToken<\/code> — crash<\/td><\/tr>
CVE-2026-9751<\/td>Medium<\/td>setParameter<\/code> logava credenciais em plaintext (ex: ldapQueryPassword<\/code>)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n

\u26a0\ufe0f CVE-2026-9740 merece atencao especial:<\/strong> permite DoS por usuario nao autenticado via BSON validator. Qualquer porta mongod<\/code> ou mongos<\/code> exposta e um vetor de ataque imediato.<\/p>\n<\/blockquote>\n\n\n\n

Alem das CVEs do servidor, os binarios mongodump<\/code>\/tools foram recompilados com golang.org\/x\/crypto v0.52.0<\/code> e golang.org\/x\/net v0.55.0<\/code>, fechando 15 CVEs adicionais nas bibliotecas Go.<\/p>\n\n\n\n

Ambiente do lab<\/h2>\n\n\n\n
Host<\/th>IP<\/th>Role<\/th><\/tr><\/thead>
mongo-vm01<\/td>192.168.15.180<\/td>PRIMARY<\/td><\/tr>
mongo-vm02<\/td>192.168.15.181<\/td>SECONDARY<\/td><\/tr>
mongo-vm03<\/td>192.168.15.182<\/td>SECONDARY<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n
  • OS:<\/strong> Oracle Linux 8<\/li>\n\n\n\n
  • Replica Set:<\/strong> rs-source<\/code><\/li>\n\n\n\n
  • Versao anterior:<\/strong> 8.0.23-10<\/code><\/li>\n\n\n\n
  • Versao alvo:<\/strong> 8.0.26-11<\/code><\/li>\n<\/ul>\n\n\n\n

    Tem downtime?<\/h2>\n\n\n\n

    Nao<\/strong>, desde que a connection string da aplicacao use retryWrites=true<\/code>:<\/p>\n\n\n\n

    <\/circle><\/circle><\/circle><\/g><\/svg><\/span>