EUVD-2026-47792Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and low-complexity but requires authenticated low-privilege access (PR:L); impact is availability-only (A:H) with no confidentiality or integrity loss.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.
AnalysisAI
Denial of service in MongoDB Server allows an authenticated user to exhaust CPU or trigger out-of-memory conditions by submitting a crafted Queryable Encryption 'find' payload whose unvalidated field drives an internal computation loop. The resulting resource exhaustion degrades availability for all other operations on the affected instance. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is tracked internally as MongoDB SERVER-127566.
Technical ContextAI
The flaw resides in MongoDB's Queryable Encryption (QE) feature, which lets applications run equality and range queries directly against encrypted fields without decrypting them server-side. Processing a QE 'find' request involves server-side computation over encrypted index structures, and this vulnerability stems from an attacker-controllable field within that payload being used to bound an internal loop without validation. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): because the field that governs loop iterations or associated memory allocation is trusted rather than sanity-checked, an attacker can force disproportionate CPU cycles or memory allocation. This is a classic input-to-resource amplification pattern where a small crafted request produces an outsized server-side workload.
RemediationAI
Consult the MongoDB advisory tracked at https://jira.mongodb.org/browse/SERVER-127566 and upgrade to the patched MongoDB Server release identified there; no vendor-released patch version was included in the available data, so the exact fixed version must be confirmed from that advisory. As compensating controls until patching, tighten authentication and authorization so that only trusted, least-privilege roles can issue queries against Queryable Encryption collections - removing 'find' access for untrusted or multi-tenant accounts directly removes the exploitation precondition (trade-off: may break applications that legitimately query encrypted fields). Where feasible, place the database behind connection rate-limiting or per-user resource governance and monitor for anomalous CPU/memory spikes correlated with QE queries so a resource-exhaustion attempt can be detected and the offending session terminated (trade-off: monitoring is detective, not preventive). Restrict network exposure of the MongoDB port to application hosts only to reduce the pool of principals who could authenticate and abuse the endpoint.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e
Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to cras
MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr
A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today