CVE-2026-96299
Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory.
Published Oct 13, 2026
Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory. Internal schema validation operators that are meant only for server use are accepted in user-supplied query filters. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without a sufficient limit on the resources used. This can cause memory use to grow until the mongod process runs out of memory and terminates. The behavior can occur when an authenticated user with read-only privileges runs an aggregation query that nests these operators.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Tenable CVE Database
Detected
Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory. Internal schema validation operators that are meant only for server use are accepted in user-supplied query filters. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without a suffi
Sources
- CVE.orgCVE-2026-96299
Official CVE identifier
cve.org - Tenable CVE DatabaseCVE-2026-96299
Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory. Internal schema validation operators that are meant only for server use are accepted in user-supplied query filters. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without a suffi
tenable.com