CVE-2026-18687

The record

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.

Affected packages

Related vulnerabilities

• CVE-2026-121727 Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body… CWE-191
• CVE-2026-61497 TinyUSB before 0.20.1 contains an integer underflow vulnerability in the HID host report… CWE-191
• CVE-2026-120060 psqlODBC trusts counts and lengths in server data in three places. CWE-191
• CVE-2026-120058 psqlODBC sizes its row cache from the column count of a cursor's first result, but… CWE-191
• CVE-2026-20576 In afe, there is a possible out of bounds write due to a missing bounds check. CWE-191
• CVE-2026-20572 In adsp, there is a possible out of bounds write due to an integer overflow. CWE-191
• CVE-2026-111735 P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). CWE-191
• CVE-2026-103411 An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session… CWE-191