Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-120812 EUVD-2026-122826GHSA-2m54-68f4-wv2w

Full server crash via unbounded per-operand recursion in time-series query vectorization

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by mongodb

Description

An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process termination when processing certain queries against time-series collections.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 9.0.0 – < 9.0.7, 8.3.0 – < 8.3.16 9.0.7

Advisories 1

References