{"id":"CVE-2026-120812","kind":"vulnerability","aliases":["CVE-2026-120812"],"related":[],"title":"MongoDB Server: crafted time-series query exhausts stack and crashes server","description":"An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process termination when processing certain queries against time-series collections.","summary":"MongoDB Server's query compiler recurses without limit when it processes certain queries against time-series collections. A user with read access can send such a query and make the server process stop.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["databases","mongodb","runtime","self-hosted"],"not_affected_if":["no-time-series-collections","no-untrusted-read-users"],"how_to_check":"- Run `db.version()` in the mongo shell and compare against the fixed versions the sources name (unknown in the sources given).\n- Check whether any time-series collections are queried by users with read privileges.","fix":null,"status":"open","published_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:48:08+00:00","updated_at":"2026-11-10T20:48:08+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T20:48:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB Server: crafted time-series query exhausts stack and crashes server","impact":"low","summary":"MongoDB Server's query compiler recurses without limit when it processes certain queries against time-series collections. A user with read access can send such a query and make the server process stop.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["mongodb","self-hosted","databases"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Server process terminates, causing denial of service for all clients","analyst_note":"Find affected and fixed MongoDB Server versions from the MongoDB advisory for CVE-2026-120812; the NVD entry gives none.","how_to_check":"- Run `db.version()` in the mongo shell and compare against the fixed versions the sources name (unknown in the sources given).\n- Check whether any time-series collections are queried by users with read privileges.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-time-series-collections","no-untrusted-read-users"],"who_is_affected":"Deployments running MongoDB Server that have time-series collections and users or applications with read privileges. Attackers need an authenticated account with read access; the sources do not say which versions are affected beyond this description, so check the vendor advisory.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4537,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120812':15A,18A '-2026':14A,17A 'access':47B 'allow':68C 'authent':70C 'caus':76C 'certain':36B,100C 'collect':42B,106C 'compil':29B,87C 'compon':67C,88C 'craft':3A 'crash':11A 'cve':13A,16A 'databas':19B 'denial':78C 'exhaust':8A,93C 'host':24B 'intern':85C 'issu':60C 'lead':90C 'limit':32B 'make':54B 'mongodb':1A,20B,25B,62C 'privileg':74C 'process':35B,57B,66C,96C,99C 'queri':7A,28B,37B,52B,65C,86C,101C 'read':46B,73C 'recurs':30B,82C 'runtim':21B 'self':23B 'self-host':22B 'send':49B 'seri':6A,41B,105C 'server':2A,12A,26B,56B,63C,95C 'servic':80C 'stack':9A,92C 'stop':58B 'termin':97C 'time':5A,40B,104C 'time-seri':4A,39B,103C 'uncontrol':81C 'user':44B,71C 'without':31B","nicknames":[],"mitigations":[],"who_affected":"Deployments running MongoDB Server that have time-series collections and users or applications with read privileges. Attackers need an authenticated account with read access; the sources do not say which versions are affected beyond this description, so check the vendor advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databases","medium","mongodb","runtime","selfhosted"],"campaign_type":null,"search_a":"'-120812':15A,18A '-2026':14A,17A 'craft':3A 'crash':11A 'cve':13A,16A 'exhaust':8A 'mongodb':1A 'queri':7A 'seri':6A 'server':2A,12A 'stack':9A 'time':5A 'time-seri':4A","search_b":"'access':47B 'certain':36B 'collect':42B 'compil':29B 'databas':19B 'host':24B 'limit':32B 'make':54B 'mongodb':20B,25B 'process':35B,57B 'queri':28B,37B,52B 'read':46B 'recurs':30B 'runtim':21B 'self':23B 'self-host':22B 'send':49B 'seri':41B 'server':26B,56B 'stop':58B 'time':40B 'time-seri':39B 'user':44B 'without':31B","search_c":"'allow':68C 'authent':70C 'caus':76C 'certain':100C 'collect':106C 'compil':87C 'compon':67C,88C 'denial':78C 'exhaust':93C 'intern':85C 'issu':60C 'lead':90C 'mongodb':62C 'privileg':74C 'process':66C,96C,99C 'queri':65C,86C,101C 'read':73C 'recurs':82C 'seri':105C 'server':63C,95C 'servic':80C 'stack':92C 'termin':97C 'time':104C 'time-seri':103C 'uncontrol':81C 'user':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120812","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120812","severity":null,"published_at":"2026-11-10T20:18:51+00:00","modified_at":"2026-11-10T20:18:51+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}