CVE-2026-13069

EUVD-2026-47792
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mongodbCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
mongodbmongodb
7.0 ≤
𝑥
< 7.0.39
CNA
mongodbmongodb
8.0 ≤
𝑥
< 8.0.28
CNA
mongodbmongodb
8.2.0 ≤
𝑥
< 8.2.12
CNA
mongodbmongodb
8.3.0 ≤
𝑥
< 8.3.7
CNA
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/SERVER-127566