Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MongoDB | MongoDB Server | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://jira.mongodb.org/browse/SERVER-130431 |
|
Tue, 13 Oct 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Missing limits on resource use in the match expression evaluator of MongoDB Server can cause the server to consume excessive memory. Internal schema validation operators that are meant only for server use are accepted in user-supplied query filters. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without a sufficient limit on the resources used. This can cause memory use to grow until the mongod process runs out of memory and terminates. The behavior can occur when an authenticated user with read-only privileges runs an aggregation query that nests these operators. | |
| Title | MongoDB Nested `$_internalSchemaAllElemMatchFromIndex` Cross-Product MatchExpression OOM | |
| Weaknesses | CWE-770 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: mongodb
Published:
Updated: 2026-10-13T15:27:57.250Z
Reserved: 2026-09-22T22:29:05.501Z
Link: CVE-2026-96299
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.