CVE-2026-1849 | THREATINT

Description

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

PUBLISHED Reserved 2026-02-03 | Published 2026-02-10 | Updated 2026-02-10 | Assigner mongodb

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-674 Uncontrolled Recursion

Product status

Default status

unaffected

8.0 (semver) before 8.0.18

affected

7.0 (semver) before 7.0.29

affected

8.2 (semver) before 8.2.2

affected

References

jira.mongodb.org/browse/SERVER-102364

cve.org (CVE-2026-1849)

nvd.nist.gov (CVE-2026-1849)

Download JSON