CVE-2026-1849
CVE-2026-1849 · Mongod can run out of stack memory when expressions create deeply nested documents
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
mongodb server
- Versions
- ≥ 8.0, < 8.0.18: Affected (semver)
- ≥ 7.0, < 7.0.29: Affected (semver)
- ≥ 8.2, < 8.2.2: Affected (semver)
Update to 7.0.29; Update to 8.0.18; Update to 8.2.2
mongodb Ubuntu:Pro:18.04:LTS
- Versions
- 1:3.4.7-1
- 1:3.4.7-1ubuntu1
- 1:3.4.7-1ubuntu2
- 1:3.4.7-1ubuntu4
- 1:3.4.14-3ubuntu1
- 1:3.4.14-3ubuntu2
- 1:3.6.3-0ubuntu1
- 1:3.6.3-0ubuntu1.1
- 1:3.6.3-0ubuntu1.3
- 1:3.6.3-0ubuntu1.4
- 1:3.6.3-0ubuntu1.4+esm1
- 1:3.6.3-0ubuntu1.4+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mongodb Ubuntu:Pro:20.04:LTS
- Versions
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3
- 1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published