Resource Mismanagement in MongoDB Server Leading to Excessive Memory Consumption

CVE-2026-96299

What is CVE-2026-96299?

The MongoDB Server contains a vulnerability where insufficient limits on resource consumption within the match expression evaluator can lead to excessive memory usage. This issue is particularly notable when internal validation operators, intended strictly for server use, are inadvertently accepted in user-supplied query filters. Nesting these operators can result in the server evaluating numerous combinations of array elements, ultimately causing significant memory growth that may lead to the termination of the mongod process. This vulnerability is triggered when an authenticated user with read-only permissions executes an aggregation query that employs these nested operators.

References