CVE-2026-1848

Connections received from the proxy port may not count towards total accepted connections

State: Published
Severity: 8.2 High
Published: Feb 10, 2026
Updated: Feb 11, 2026
Reserved: Feb 3, 2026

Description

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	mongodb
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	mongodb

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
MongoDB ServerMongoDB Inc	8.2 to before 8.2.4Affected 8.0 to before 8.0.18Affected 7.0 to before 7.0.29Affected

References

https://jira.mongodb.org/browse/SERVER-114695

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.