CVE Feed

    Dashboard / CVE / CVE-2026-13075

    CVE-2026-13075

    An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

    Published:Jul 22, 2026
    Last Modified:Aug 18, 2026
    EPS:Jul 22, 2026
    EPSS Score:0.00235
    CVSS Score:6.5

    Affected Products

    Vendor
    Mongodb
    Product
    Mongodb
    Vendor
    Mongodb
    Product
    Mongodb Server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-84967 (CVSS 5.1) — A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connec…
    CVE-2026-13071 (CVSS 7.1) — An authenticated user with read access can cause the mongod process to be terminated through certain aggregati…
    CVE-2026-13072 (CVSS 9.2) — When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BS…
    CVE-2026-13073 (CVSS 5.3) — An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuin…
    CVE-2026-13074 (CVSS 6.9) — An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific…
    CVE-2026-13076 (CVSS 7.1) — An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pre…
    CVE-2026-13077 (CVSS 7.1) — A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds…
    CVE-2026-13078 (CVSS 6.3) — A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally …
    CVE-2026-11933 (CVSS 8.7) — A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON d…
    CVE-2026-9740 (CVSS 8.7) — A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod p…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High