MongoDB CVE-2026-1848
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionNVD
Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.
AnalysisAI
MongoDB proxy port connections bypass connection accounting mechanisms, allowing unauthenticated remote attackers to exhaust server resources and trigger denial of service without authentication. Servers relying on connection limits for resource management are vulnerable to crashes when connection counts are artificially inflated through the proxy protocol. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running affected software with proxy ports enabled and document current connection limits and baseline traffic patterns. Within 7 days: Implement compensating controls including connection rate limiting, network segmentation to restrict proxy port access, and enhanced monitoring of connection counts and server resource utilization. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today