CVE-2026-1849: Mongod can run out of stack memory when expressions create deeply nested documents
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1849?
CVE-2026-1849 is considered a critical vulnerability due to the potential for out-of-memory failures in MongoDB Server.
How does CVE-2026-1849 affect MongoDB Server?
CVE-2026-1849 causes MongoDB Server to run out of stack memory when expressions evaluate deeply nested documents.
What are the potential impacts of CVE-2026-1849?
The potential impacts of CVE-2026-1849 include server crashes and disrupted services due to out-of-memory errors.
How can I mitigate CVE-2026-1849?
Mitigation for CVE-2026-1849 involves using best practices to avoid deeply nested documents and monitoring server performance.
Which versions of MongoDB Server are affected by CVE-2026-1849?
CVE-2026-1849 affects all currently supported versions of MongoDB Server that do not implement patched solutions.