CVE-2026-13069
published 2026-07-22CVE-2026-13069: An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.29%
20.5th percentile
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 7.0.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb | >= 8.0.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb | >= 8.3.0 < 8.3.7 | 8.3.7 |
| mongodb | mongodb_server | >= 7.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb_server | >= 8.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb_server | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.7 | 8.3.7 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6 Queryable Encryption resource consumption
vuldb·2026-07-22·CVSS 6.5
CVE-2026-13069 [MEDIUM] MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6 Queryable Encryption resource consumption
A vulnerability classified as problematic was found in MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6. The affected element is an unknown function of the component Queryable Encryption. The manipulation results in resource consumption.
This vulnerability is known as CVE-2026-13069. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
GHSA
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to
ghsa_unreviewed·2026-07-22
CVE-2026-13069 [HIGH] CWE-770 An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-22
Published