PT-2026-63476 · Mongodb · Mongodb Server

CVE-2026-13072 · Publicado 2026-07-22 · Atualizado 2026-07-22

NVD

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

Correção

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-122

Identificadores relacionados

CVE-2026-13072

Produtos afetados

Mongodb Server

Referências · 2

• https://jira.mongodb.org/browse/SERVER-128494 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-13072 · Nota de Segurança