CVE-2026-18699 describes a denial of service vulnerability in MongoDB Server's query planner. An authenticated user with read privileges can trigger a server crash by submitting a specially formed query targeting a collection with a text index. This vulnerability leads to unexpected termination of the server process, disrupting availability for connected clients and in-flight operations. The vulnerability is classified under CWE-476 (NULL Pointer Dereference). The CVSS 3.1 base score is 6.5 (medium severity) with attack vector network, low attack complexity, privileges required (low), no user interaction, unchanged scope, and impact limited to availability.

The vulnerability allows denial of service by crashing the MongoDB server process, impacting availability for all connected clients and ongoing operations. There is no impact on confidentiality or integrity. The attacker must be authenticated with read-level privileges to exploit this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict read-level access to trusted users and monitor for unusual query patterns targeting text indexes. No official fix or workaround information is provided in the current data.