Every CVE Search/ Get API key

CVE-2026-18693

Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

7.2 HighFix available

CVE-2026-18693 is a high vulnerability (CVSS 7.2) in Mongodb, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in mongodb 7.0.40.

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.34%Up 0.1 points since Aug 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.2

Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Record
CVE-2026-18693
CVSS 4.0
7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-56909 7.2

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Record
EUVD-2026-56909
CVSS 4.0
7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4f9m-g9cm-wxq9 7.2

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user...

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Record
GHSA-4f9m-g9cm-wxq9
CVSS 4.0
7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.2

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Record
CVE-2026-18693
CVSS 4.0
7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 7.2

Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Record
CVE-2026-18693
CVSS 4.0
7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
OSVUBUNTU-CVE-2026-18693 7.2

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Record
UBUNTU-CVE-2026-18693
CVSS 4.0
7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVBIT-mongodb-2026-18693 No score

Out-of-Bounds Read/Write in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Memory Disclosure

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.

Record
BIT-mongodb-2026-18693
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mongodb
Bitnami
7.0.0 up to 7.0.40, 8.0.0 up to 8.0.29, 8.2.0 up to 8.3.8, 9.0.0 up to 9.0.2
7.0.408.0.298.3.89.0.2
mongodb
Ubuntu:Pro:14.04:LTS
All versions, plus listed versions
1:2.4.6-0ubuntu51:2.4.6-0ubuntu61:2.4.8-1ubuntu11:2.4.8-21:2.4.9-11:2.4.9-1ubuntu11:2.4.9-1ubuntu21:2.4.9-1ubuntu2+esm2
None known
mongodb
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
1:2.6.10-0ubuntu11:2.6.10-0ubuntu1+esm2
None known
mongodb
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1:3.4.7-11:3.4.7-1ubuntu11:3.4.7-1ubuntu21:3.4.7-1ubuntu41:3.4.14-3ubuntu1
Show 7 moreShow less
1:3.4.14-3ubuntu21:3.6.3-0ubuntu11:3.6.3-0ubuntu1.11:3.6.3-0ubuntu1.31:3.6.3-0ubuntu1.41:3.6.3-0ubuntu1.4+esm11:3.6.3-0ubuntu1.4+esm2
None known
mongodb
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu51:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.21:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.31:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1
None known

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

MoveEnter Open