EUVD-2026-47779Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity trigger requiring an authenticated low-privilege query user (PR:L), no user interaction, with impact limited to availability (A:H) via OOM crash.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.
AnalysisAI
Denial of service in MongoDB Server allows an authenticated database user to submit an aggregation/query expression that generates very large arrays, forcing the server to allocate oversized intermediate objects in memory and crash with an out-of-memory (OOM) error. Reported by MongoDB's own CNA and tracked in SERVER-124355, the flaw carries a CVSS 4.0 base score of 7.1 with an availability-only impact (VA:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MongoDB user (PR:L) with the ability to run queries or aggregations against the server; the attacker must craft an expression using array-generating operators that produce a very large array, causing an oversized intermediate object to be allocated during query evaluation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are internally consistent and point to a moderate, availability-only DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user with ordinary query privileges - such as a tenant in a shared database or a compromised low-privilege application account - sends a crafted aggregation containing an expression that expands into an enormous array. The server attempts to materialize the oversized intermediate object, exhausts available memory, and the mongod process crashes with an OOM error, disrupting service for all users. … |
| Remediation | No vendor-released patch version is identified in the provided data; the fix is tracked in MongoDB Jira issue SERVER-124355 (https://jira.mongodb.org/browse/SERVER-124355), which should be consulted for the exact patched release once published, and clusters should be upgraded to that fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all database user accounts and remove unnecessary aggregation pipeline permissions; implement principle-of-least-privilege database access policies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today