What is the CVSS score of CVE-2026-1848?

CVE-2026-1848 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of MongoDB are affected by CVE-2026-1848?

CVE-2026-1848 creates a resource exhaustion vulnerability where proxy connections are not properly tracked, potentially causing service crashes and business disruption.

How to fix or mitigate CVE-2026-1848?

Within 24 hours: Identify all systems running affected software with proxy ports enabled and document current connection limits and baseline traffic patterns. Within 7 days: Implement compensating controls including connection rate limiting, network segmentation to restrict proxy port access, and enhanced monitoring of connection counts and server resource utilization. Within 30 days: Establish vendor communication channels to track patch release timelines and prepare deployment procedures; conduct load testing to validate mitigation effectiveness.

MongoDB CVE-2026-1848

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-02-10 cna@mongodb.com

Denial Of Service MongoDB

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 19:15 nvd

HIGH 7.5

DescriptionCVE.org

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.

AnalysisAI

MongoDB proxy port connections bypass connection accounting mechanisms, allowing unauthenticated remote attackers to exhaust server resources and trigger denial of service without authentication. Servers relying on connection limits for resource management are vulnerable to crashes when connection counts are artificially inflated through the proxy protocol. No patch is currently available for this high-severity issue affecting MongoDB deployments.

Technical ContextAI

Classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Affects Mongodb. Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.