CVE-2026-1849

7.1 highEPSS 0.3%

High (7.1) in mongodb mongodb. EPSS 0.3% chance of exploitation in the next 30 days.

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-674
Published: 2026-02-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mongodb:mongodb

References

https://jira.mongodb.org/browse/SERVER-102364

Check your stack JSON