CVE-2026-1849CWE-674

Mongod can run out of stack memory when expressions create deeply nested documents

High · published February 10, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
23.7
In the wild
Unconfirmed
What it is

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00319 · 23.7th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-02-10T18:52Z
EPSS history
Timeline
  • 10 FEB 18:52Z
    Mongod can run out of stack memory when expressions create deeply nested documents
    cvelistv5