CVE-2026-1848 HIGH

CVE-2026-1848: Connections received from the proxy port may not count towards total accepted connections

Vendor Mongodb Inc
Product MongoDB Server
Weakness CWE-770 · Uncontrolled resource consumption
Published February 10, 2026
Last update February 11, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, pending the proxy protocol header.

Key dates

02Disclosure timeline

February 10, 2026 CVE published
February 11, 2026 Record updated