Authenticated User Manipulation in MongoDB Server Leads to Process Termination
CVE-2026-13075

7.1HIGH

Key Information:

Vendor

Mongodb
Status
Mongodb Server
Vendor
CVE Published:
22 July 2026

What is CVE-2026-13075?

An issue has been identified in MongoDB that allows an authenticated user to cause the termination of the mongod process due to memory pressure conditions during the execution of specific aggregation stages, namely $rankFusion and $scoreFusion. This vulnerability originates from the server's error-handling mechanisms and necessitates that the user has the capability to run aggregation queries, highlighting a potential risk for systems running affected versions of the database.

Affected Version(s)

MongoDB Server 8.2.0 < 8.2.12

MongoDB Server 8.3.0 < 8.3.7

References

https://jira.mongodb.org/browse/SERVER-128316

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.