2 lines
4.5 KiB
JSON
2 lines
4.5 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"MongoDB Server","vendor":"MongoDB Inc","versions":[{"lessThan":"8.0.18","status":"affected","version":"8.0","versionType":"semver"},{"lessThan":"7.0.29","status":"affected","version":"7.0","versionType":"semver"},{"lessThan":"8.2.2","status":"affected","version":"8.2","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"0EE77D5B-E587-4992-8E30-F3E8D085B00C","versionEndExcluding":"7.0.29","versionStartIncluding":"7.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"4F6EFC47-E40A-4429-B6CD-27E497A9754F","versionEndExcluding":"8.0.18","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*","matchCriteriaId":"4E2374C5-A865-4B1D-9729-728A9F74BE54","versionEndExcluding":"8.2.2","versionStartIncluding":"8.2.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents. The issue arises in recursive functions because the server does not periodically check the depth of the expression."},{"lang":"es","value":"Servidor MongoDB puede experimentar un fallo por falta de memoria mientras evalúa expresiones que producen documentos profundamente anidados. El problema surge en funciones recursivas porque el servidor no comprueba periódicamente la profundidad de la expresión."}],"id":"CVE-2026-1849","lastModified":"2026-06-17T10:16:36.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1849","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-02-10T19:16:27.778333Z","version":"2.0.3"}}]},"published":"2026-02-10T19:15:51.477","references":[{"source":"cna@mongodb.com","tags":["Vendor Advisory"],"url":"https://jira.mongodb.org/browse/SERVER-102364"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cna@mongodb.com","type":"Secondary"}]}
|