CVE-2026-120812

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process termination when processing certain queries against time-series collections.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1208135.9An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silentl CVE-2026-1208147.2An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrati CVE-2026-1208158.4An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to CVE-2026-1208164.3A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents CVE-2026-1208176.5A race condition in the schema validation component of MongoDB Server can occur when concurrent writes are checked against a collection vali CVE-2026-1208187.1A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed CVE-2026-1208194.3A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only re CVE-2026-120827.5The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthent CVE-2026-1208204.3MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are c CVE-2026-1208216.5A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipel CVE-2026-1208226.7MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because t CVE-2026-1208234.3A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an ac