EUVD-2026-47798Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable via aggregation commands with low-privilege credentials; mongod process termination warrants A:H with no confidentiality or integrity impact.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.
AnalysisAI
Denial of service against the MongoDB mongod process is achievable by any authenticated user holding standard read/write privileges by submitting a crafted aggregation command that exploits insufficient input validation in the bundled libmongocrypt library. An integer overflow (CWE-190) in libmongocrypt allows attacker-controlled payload values to produce an excessively large memory allocation request, causing the operating system to terminate the mongod process under an out-of-memory condition. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
The vulnerability resides in MongoDB's libmongocrypt library, the component responsible for client-side field-level encryption, queryable encryption, and related cryptographic payload processing within the MongoDB server. CWE-190 (Integer Overflow or Wraparound) is the root cause class: when parsing aggregation command payloads, libmongocrypt fails to adequately bound or validate attacker-supplied numeric values, permitting an integer arithmetic overflow that produces an abnormally large computed allocation size. The resulting heap allocation exhausts process memory and triggers an OOM kill of the mongod process. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the path is network-reachable, requires no special attack conditions beyond low-privilege authentication, and carries no complexity barriers. The 'Information Disclosure' tag present in the source intelligence is not corroborated by the CVE description, which identifies only an availability impact; this discrepancy should be clarified with MongoDB.
RemediationAI
No vendor-released patch version has been confirmed from the available data. The MongoDB Jira ticket SERVER-127737 (https://jira.mongodb.org/browse/SERVER-127737) tracks this issue, but no specific fixed release is cited in the reference material - patch availability per vendor advisory should be checked directly on that ticket and MongoDB's security advisories page. As compensating controls, administrators should apply least-privilege access controls to restrict which user accounts hold read/write privileges and can execute aggregation pipelines, and should consider monitoring aggregation command patterns for anomalous payload sizes using MongoDB's database profiler or audit log. In replica set deployments, verifying that automatic failover and priority settings are correctly configured reduces the availability impact of a single mongod termination. Disabling libmongocrypt-dependent features such as Client-Side Field Level Encryption or Queryable Encryption is not advised as a general workaround without vendor guidance, as the precise code path within libmongocrypt that handles standard aggregation payloads may differ. Monitor MongoDB's security announcements for a patched release.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today