CVE-2026-1848: Connections received from the proxy port may not count towards total accepted connections
Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1848?
CVE-2026-1848 is classified as a moderate severity vulnerability due to its potential to cause server crashes.
How do I fix CVE-2026-1848?
To mitigate CVE-2026-1848, update MongoDB to a version beyond 7.0.29, 8.0.18, or 8.2.4 depending on your current version.
What are the consequences of CVE-2026-1848?
CVE-2026-1848 can lead to server crashes if the total number of connections exceeds system resources, caused by proxy connections not being counted.
Which versions of MongoDB are affected by CVE-2026-1848?
CVE-2026-1848 affects MongoDB versions 7.0.0 to 7.0.29, 8.0.0 to 8.0.18, and 8.2.0 to 8.2.4.
Is CVE-2026-1848 a remote code execution vulnerability?
CVE-2026-1848 is not a remote code execution vulnerability; it specifically pertains to connection handling within the server.