CVE-2026-18688
Full vulnerability record from the local CVENow database.
Description
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.
Severity
HIGH
CVSS score
7.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-08-11 19:17:22.620000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-18688",
"sourceIdentifier": "[email protected]",
"published": "2026-08-11T19:17:22.620",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents."
},
{
"lang": "es",
"value": "Un problema en el framework de agregación del servidor MongoDB podría permitir a un usuario autenticado desencadenar una lectura de memoria fuera de límites al proporcionar un parámetro numérico especialmente formado en una determinada etapa de la pipeline de agregación. Esto podría resultar en una caída del servidor (denegación de servicio) y podría exponer potencialmente una cantidad limitada del contenido de la memoria."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "MongoDB",
"product": "MongoDB Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.3.0",
"lessThan": "8.3.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.0",
"lessThan": "8.0.29",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0",
"lessThan": "7.0.40",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 4.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-11T20:26:36.495360Z",
"id": "CVE-2026-18688",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.0.40",
"matchCriteriaId": "F3DB18E4-812C-4E04-802D-5D6B61CE9D1B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.0.0",
"versionEndExcluding": "8.0.29",
"matchCriteriaId": "4DC64BC6-1D47-4809-9616-95A7CF59DC37"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.2.0",
"versionEndIncluding": "8.2.12",
"matchCriteriaId": "7BCD6B05-9FD5-4283-A2AC-8B625425597F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.3.0",
"versionEndExcluding": "8.3.8",
"matchCriteriaId": "6EE4503A-F53C-432E-9DDB-F488DD989E8A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*",
"matchCriteriaId": "0FB52026-6C88-4401-84B5-3A070F0906D4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*",
"matchCriteriaId": "8D32A105-731C-493E-8CBF-639204CDAC7C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*",
"matchCriteriaId": "D56E512D-83F8-4D51-8690-E92F6A006822"
}
]
}
]
}
],
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-129617",
"source": "[email protected]",
"tags": [
"Vendor Advisory",
"Issue Tracking"
]
}
]
}