Junglewise Threat Intelligence

CVE-2026-18695: MongoDB Server denial of service in time-series query handling

CVE-2026-18695 · Severity: medium · CVSS 6.5 · Published 2026-08-11

Technologies: MongoDB Server. Vendors: MongoDB.

Executive brief

MongoDB Server's handling of specific query predicates against time-series data collections can be exploited by authenticated users with write permissions to crash the database server. An attacker with legitimate database access could trigger this vulnerability to cause a denial of service, disrupting database availability and requiring manual server restart.

Technical details

This vulnerability exists in MongoDB Server's query processor when handling certain query predicates against time-series collections with a metaField defined. The issue occurs during update operations where invalid jsonSchema filters are applied to time-series collections, causing a server crash (denial of service). The vulnerability requires authentication and write access to the affected collection; an attacker must be able to execute update commands with malformed $jsonSchema predicates. MongoDB has patched this issue in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, and 9.1.0-rc0.

Affected products

  • MongoDB Server before 7.0.40, 8.0.x before 8.0.29, 8.1.x before 8.2.13, 8.3.x before 8.3.8, 9.0.x before 9.0.0-rc2, 9.1.x before 9.1.0-rc0

Timeline

  • 2026-08-11: disclosed: Advisory published
  • 2026-08-11: patched: Fixed in versions 7.0.40, 8.0.29, 8.2.13, 8.3.8, 9.0.0-rc2, 9.1.0-rc0

References