Back to overview

CVE-2026-13076

MEDIUM
6.5
CVSS 3.1
Description
An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.

Metadata

CVE ID
CVE-2026-13076
State
PUBLISHED
Assigner
mongodb
Reserved
2026-06-23 18:00 UTC
Published
2026-07-22 19:12 UTC
Last updated
2026-07-22 19:12 UTC
Primary CWE
CWE-770
CWE-770: Allocation of Resources Without Limits or Throttlin…
Vendor / Product
MongoDB / MongoDB Server
Sources
cve.org  ·  NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products (1)
VendorProductPlatformVersions
MongoDB MongoDB Server — 8.3.0 < 8.3.7
Weakness (CWE)
CWESourceDescription
CWE-770 cna CWE-770: Allocation of Resources Without Limits or Throttling
CVSS scores (2)
ScoreSeverityVersionSourceVector
7.1 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References (1)
Back to overview