CVE-2026-1849: 
MongoDB vulnerability analysis and mitigation

CVE-2026-1849 is an uncontrolled recursion vulnerability in MongoDB Server that can cause out-of-memory (OOM) failures when evaluating expressions that produce deeply nested documents. The server fails to periodically check expression depth within recursive functions, allowing authenticated attackers to trigger denial-of-service conditions. Affected versions include MongoDB 7.0.0–7.0.28, 8.0.0–8.0.17, and 8.2.0–8.2.1. It was published on February 10, 2026, with a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, MongoDB Jira).

The root cause is classified as CWE-674 (Uncontrolled Recursion): MongoDB Server's expression evaluation engine does not enforce depth limits during recursive processing of nested document expressions. An authenticated attacker with low privileges can craft aggregation pipeline queries or expressions that generate arbitrarily deep document nesting, exhausting server memory. The attack requires no user interaction and is exploitable over the network with low complexity. This is related to CAPEC-230 (Serialized Data with Nested Payloads) and CAPEC-231 (Oversized Serialized Data Payloads) (MongoDB Jira, Red Hat Advisory).

Successful exploitation results in an out-of-memory crash of the MongoDB Server process, causing a complete denial of service with high availability impact. There is no confidentiality or integrity impact — attackers cannot read or modify data through this vulnerability. Any authenticated user with access to execute aggregation or expression operations can trigger the crash, making this a significant risk in multi-tenant or shared MongoDB environments where low-privilege accounts exist (Red Hat Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. However, the low attack complexity and network-accessible attack vector make it relatively straightforward for any authenticated user to attempt (Red Hat Advisory, MongoDB Jira).

1. Reconnaissance: Identify MongoDB Server instances running affected versions (7.0.0–7.0.28, 8.0.0–8.0.17, or 8.2.0–8.2.1) accessible over the network on the default port (27017).
2. Authentication: Authenticate to the MongoDB instance using any valid low-privilege account credentials.
3. Craft malicious expression: Construct an aggregation pipeline query or expression that generates deeply nested document structures — for example, using $let, $map, or similar recursive expression operators to produce documents with extreme nesting depth.
4. Submit query: Execute the crafted query against the target MongoDB database. The server's recursive evaluation engine will process the expression without checking depth, consuming increasing amounts of memory.
5. Trigger OOM crash: The server exhausts available memory and crashes, resulting in a denial of service for all connected clients (MongoDB Jira).

• Logs: MongoDB server logs showing sudden process termination with out-of-memory errors (e.g., OOM killer messages on Linux, or abrupt mongod process exit); repeated aggregation queries with unusual complexity or nesting patterns from a single user or IP.
• Process: Rapid memory consumption by the mongod process leading to OOM kill events visible in system logs (/var/log/syslog or dmesg on Linux).
• Network: High-frequency aggregation pipeline requests from a single authenticated client to MongoDB port (default 27017) containing deeply nested expression structures.

MongoDB has released patched versions addressing this vulnerability: upgrade to 7.0.29 or later, 8.0.18 or later, or 8.2.2 or later depending on your current version. As interim mitigations, restrict authentication credentials to limit which users can execute aggregation pipeline or expression operations, implement network segmentation to allow only trusted sources to reach MongoDB ports, and consider enforcing connection and resource limits. Monitor MongoDB logs for aggregation queries with unusual nesting patterns (MongoDB Jira, Red Hat Advisory).