CVE-2026-1848: high-severity vulnerability in MongoDB Server
Connections received from the proxy port may not count towards total accepted connections
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.3%
Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
MongoDB Inc · MongoDB ServerRelated CVEs — MongoDB Server
In the same product, most dangerous first.
CVE-2026-25611HIGHPre-Authentication Memory Exhaustion Denial of Service in MongoDB ServerEPSS 0.9%CVE-2025-0755HIGHMongoDB C Driver bson library may be susceptible to buffer overflowEPSS 0.8%CVE-2024-8305MEDIUMMongoDB Server secondaries may crash due to forced index constraintsEPSS 0.6%CVE-2024-10921MEDIUMImproper neutralization of null bytes may lead to buffer over-reads in MongoDB ServerEPSS 0.6%CVE-2024-3372HIGHMongoDB Server may have unexpected application behaviour due to invalid BSONEPSS 0.5%CVE-2025-6709HIGHPre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC AuthenticationEPSS 0.5%