PT-2026-63480 · Mongodb · Mongodb Server

CVE-2026-13076 · Published 2026-07-22 · Updated 2026-07-22

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-13076

Affected Products

Mongodb Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-13076 · Security Note
• https://jira.mongodb.org/browse/SERVER-128584 · Note