CVE-2026-1850: 
MongoDB vulnerability analysis and mitigation

CVE-2026-1850 is a resource exhaustion vulnerability in the MongoDB Query Planner that allows complex queries to cause excessive memory usage, resulting in an Out-Of-Memory (OOM) crash. It affects MongoDB versions 8.0.0 through 8.0.17 and 8.2.0 through 8.2.3. The vulnerability was published on February 10, 2026, with a patch tracked via MongoDB's issue tracker. It carries a CVSS v3.1 base score of 7.5 (High) and is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) (Red Hat Advisory, MongoDB Jira).

The root cause is CWE-770 — allocation of resources without limits or throttling — within MongoDB's Query Planner component. When a sufficiently complex query is submitted, the Query Planner allocates memory without adequate bounds checking or throttling, eventually exhausting available system memory and crashing the MongoDB process. The attack vector is network-based, requires no user interaction, and has low attack complexity, though CVSS v4.0 notes that low privileges are required to submit queries. No public proof-of-concept code has been identified (Red Hat Advisory, MongoDB Jira).

Successful exploitation results in a denial-of-service condition through an OOM crash of the MongoDB service, causing complete unavailability of the database. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability concern. Depending on deployment architecture, a crash could affect all applications and services dependent on the MongoDB instance, potentially causing cascading outages (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, indicating a low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Tenable Nessus plugin 298778 (Tenable Nessus, Red Hat Advisory).

MongoDB has released patches addressing this vulnerability: upgrade to version 8.0.18 or later for 8.0.x deployments, or 8.2.4 or later for 8.2.x deployments. As interim mitigations, restrict network access to MongoDB services to trusted clients only, implement query complexity limits and resource throttling policies, and monitor for unusual memory consumption or OOM events. Tightening authentication controls to limit which low-privileged accounts can submit arbitrary queries can also reduce exposure (MongoDB Jira, Red Hat Advisory).