CVE-2026-18687 PUBLISHED

Improper Validation in MongoDB Queryable Encryption Maintenance Operation Leads to Denial of Service and Index Corruption

Assigner: mongodb
Reserved: 03.08.2026 Published: 11.08.2026 Updated: 11.08.2026

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor MongoDB
Product MongoDB Server
Versions Default: unaffected
  • affected from 8.3.0 to 8.3.8 (excl.)
  • affected from 8.0 to 8.0.29 (excl.)

References

Problem Types

  • CWE-191: Integer Underflow (Wrap or Wraparound) CWE