Denial of Service Vulnerability in MongoDB Product

CVE-2026-13063

What is CVE-2026-13063?

An authenticated user with standard read/write privileges can exploit this vulnerability in MongoDB by sending a specially crafted aggregation command. This can lead to a denial of service condition as it causes the mongod process to terminate due to an out-of-memory (OOM) event. The issue stems from the inadequate validation of payload-supplied values within MongoDB's libmongocrypt library, resulting in excessively large memory allocation requests.

References