CVE-2026-1849

Medium

Published: 10 February 2026

Published

10 February 2026

Modified

25 February 2026

KEV Added

—

Patch

—

CVSS Score 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0006 19.3th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1849 is a medium-severity Uncontrolled Recursion (CWE-674) vulnerability in Mongodb Mongodb. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 19.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CP-7 Alternate Processing Site

addresses: CWE-674

Supports resumption at alternate site when uncontrolled recursion causes primary site failure or crash.

SC-5 Denial-of-service Protection

addresses: CWE-674

Prevents uncontrolled recursion that exhausts stack or CPU resources.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Direct exploitation of uncontrolled recursion vulnerability to trigger OOM and crash MongoDB service, matching Application or System Exploitation for DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression.

Deeper analysisAI

CVE-2026-1849 affects MongoDB Server, where the server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue stems from recursive functions that do not periodically check the depth of the expression, leading to uncontrolled recursion as classified under CWE-674. The vulnerability has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating medium severity primarily due to high availability impact.

An attacker requires low privileges (PR:L) and can exploit this remotely over the network (AV:N) with low attack complexity and no user interaction. Exploitation involves crafting expressions that trigger deeply nested document generation, causing the recursive functions to consume excessive memory and result in an out-of-memory failure, effectively denying service to the MongoDB Server.

Mitigation details are documented in the MongoDB JIRA ticket at https://jira.mongodb.org/browse/SERVER-102364.