Medium 6.5

An issue in MongoDB Server's query processing component allows an authenticated user with read...

CVE-2026-120812 First seen on SecPulse 05:10

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
MongoDB	MongoDBMongoDB Server	≥ 9.0.0, < 9.0.7→ 9.0.7 ≥ 8.3.0, < 8.3.16→ 8.3.16	9.0.7 8.3.16

Original description The description as published by the source.

An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process termination when processing certain queries against time-series collections.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.5; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4: Medium 6.0; CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Published: Nov 11, 2026
First seen on SecPulse: 05:10
GHSA: GHSA-2m54-68f4-wv2w
CWE: CWE-674

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

All

CWE-674 Mongodb Server

Databases

MongoDB

Detection sources

NIST National Vulnerability Database07:08
GitHub Security Advisories (Global)06:34
CVE.org (CVE Program・cvelistV5)05:10