CVE-2026-18701: Type Confusion in MongoDB Query Subsystem Leads to Denial of Service
Published Aug 11, 2026
·Updated
An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.
Affected Software
1 affected component
MongoDB MongoDB Server
Event History
Aug 11, 2026
CVE Published
via MITRE·06:39 PM
Data Sourced
via MITRE·06:39 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-18701?
CVE-2026-18701 has a medium severity score of 6.5.
2
What type of vulnerability is CVE-2026-18701?
CVE-2026-18701 is a type confusion vulnerability in the MongoDB query subsystem.
3
How can CVE-2026-18701 affect my MongoDB server?
CVE-2026-18701 can lead to a denial of service, causing the MongoDB server process to terminate unexpectedly.
4
Who can exploit CVE-2026-18701?
An authenticated user with read privileges can exploit CVE-2026-18701 to submit a specially formed query filter.
5
How do I mitigate CVE-2026-18701?
To mitigate CVE-2026-18701, it is recommended to validate and sanitize input query filters before processing.