CVE-2026-1850 — Allocation of Resources Without Limits or Throttling in INC Mongodb Server

CWE-770 — Allocation of Resources Without Limits or Throttling5 documents5 sources
Severity
7.1HIGHNVD
EPSS
0.1%
top 83.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mongodb INC Mongodb ServerMongodb
Timeline
PublishedFeb 10

Description

Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDmongodb/mongodb8.0.0 — 8.0.18+1
▶CVEListV5mongodb_inc/mongodb_server8.0 — 8.0.18+1

🔴Vulnerability Details

3
OSV
CVE-2026-1850: Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash↗2026-02-10
▶
GHSA
GHSA-v4j3-xhwp-3v3w: Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash↗2026-02-10
▶
CVEList
An authorized user may disable the MongoDB server by issuing a certain type of complex query due to boolean expression simplification↗2026-02-10
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-1850 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-1850 — INC Mongodb Server vulnerability | cvebase