EUVD-2026-47779Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity trigger requiring an authenticated low-privilege query user (PR:L), no user interaction, with impact limited to availability (A:H) via OOM crash.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.
AnalysisAI
Denial of service in MongoDB Server allows an authenticated database user to submit an aggregation/query expression that generates very large arrays, forcing the server to allocate oversized intermediate objects in memory and crash with an out-of-memory (OOM) error. Reported by MongoDB's own CNA and tracked in SERVER-124355, the flaw carries a CVSS 4.0 base score of 7.1 with an availability-only impact (VA:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
The issue lies in MongoDB's query/aggregation expression evaluation engine, which builds intermediate result objects while processing expressions. Certain array-generating expressions (for example range- or repetition-style operators that expand into large arrays) can be composed to produce intermediate objects far larger than the input, without an upstream bound on the allocation size. This maps to CWE-1325 (Improperly Controlled Sequential Memory Allocation): the server sequentially allocates memory proportional to attacker-controlled array size until the process exhausts available memory. Because the allocation happens inside the mongod query pipeline, the effect is process-level memory exhaustion rather than data disclosure or corruption.
RemediationAI
No vendor-released patch version is identified in the provided data; the fix is tracked in MongoDB Jira issue SERVER-124355 (https://jira.mongodb.org/browse/SERVER-124355), which should be consulted for the exact patched release once published, and clusters should be upgraded to that fixed version. As compensating controls until patched, restrict who can run ad-hoc queries and aggregations by tightening role-based access control (grant only the minimum query roles, since exploitation requires an authenticated low-privilege user); avoid exposing mongod directly to untrusted networks; and constrain resource usage where supported (for example, memory limits/cgroups on the mongod process or container, and operator/pipeline resource limits) so a single OOM crash is contained and the service can be restarted automatically - noting that memory caps may cause legitimate large aggregations to fail and that a hard restart still interrupts availability. Application-side validation to reject or bound expressions that expand arrays can further reduce exposure at the cost of engineering effort.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today