PT-2026-63469 · Mongodb · Mongodb Server

CVE-2026-13065 · Publicado 2026-07-22 · Atualizado 2026-07-22

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2026-13065

Produtos afetados

Mongodb Server

Referências · 2

• https://jira.mongodb.org/browse/SERVER-127280 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-13065 · Nota de Segurança