CVE-2026-1849

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
MongoDB Inc	MongoDB Server	>= 8.0, < 8.0.18; >= 7.0, < 7.0.29; >= 8.2, < 8.2.2

References

https://jira.mongodb.org/browse/SERVER-102364Vendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-184908.8IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserial CVE-2026-184956.1A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when p CVE-2026-184965.3The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via t CVE-2026-184977.1A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for parsing TrueType font CVE-2026-184998.1IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.CVE-2026-18507.5Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.CVE-2026-185008.1@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({CVE-2026-185016.4The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to CVE-2026-185032.4Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when CVE-2026-185045.3fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass w CVE-2026-185055.4IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter CVE-2026-185084.4A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated