PT-2026-63473 · Mongodb · Mongodb Server

CVE-2026-13069 · Published 2026-07-22 · Updated 2026-07-22

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-13069

Affected Products

Mongodb Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-13069 · Security Note
• https://jira.mongodb.org/browse/SERVER-127566 · Note