CVE-2026-13074
published 2026-07-22CVE-2026-13074: An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello…
PriorityP433medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.44%
37.7th percentile
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mongodb | mongodb | >= 7.0.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb | >= 8.0.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb | >= 8.3.0 < 8.3.7 | 8.3.7 |
| mongodb | mongodb_server | >= 7.0 < 7.0.39 | 7.0.39 |
| mongodb | mongodb_server | >= 8.0 < 8.0.28 | 8.0.28 |
| mongodb | mongodb_server | >= 8.2.0 < 8.2.12 | 8.2.12 |
| mongodb | mongodb_server | >= 8.3.0 < 8.3.7 | 8.3.7 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6 Awaitable Hello Command Exhaust Mode resource consumption
vuldb·2026-07-22·CVSS 5.3
CVE-2026-13074 [MEDIUM] MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6 Awaitable Hello Command Exhaust Mode resource consumption
A vulnerability was found in MongoDB up to 7.0.38/8.0.27/8.2.11/8.3.6. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component Awaitable Hello Command Exhaust Mode. The manipulation leads to resource consumption.
This vulnerability is referenced as CVE-2026-13074. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is recommended.
GHSA
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode.
ghsa_unreviewed·2026-07-22
CVE-2026-13074 [MEDIUM] CWE-770 An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode.
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-22
Published