CVE-2026-13064
published 2026-07-22CVE-2026-13064: Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.45%
38.3th percentile
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 8.0.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb | >= 8.3.0 < 8.3.7 | 8.3.7 |
| mongodb | mongodb_server | >= 8.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb_server | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.7 | 8.3.7 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB up to 8.0.27/8.2.11/8.3.6 JSON Schema jsonSchema resource consumption
vuldb·2026-07-22·CVSS 6.5
CVE-2026-13064 [MEDIUM] MongoDB up to 8.0.27/8.2.11/8.3.6 JSON Schema jsonSchema resource consumption
A vulnerability was found in MongoDB up to 8.0.27/8.2.11/8.3.6 and classified as problematic. The impacted element is an unknown function of the component JSON Schema. Such manipulation of the argument jsonSchema leads to resource consumption.
This vulnerability is referenced as CVE-2026-13064. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion.
ghsa_unreviewed·2026-07-22
CVE-2026-13064 [HIGH] CWE-407 Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion.
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-22
Published