CVE-2026-13069CWE-770denial-of-service

CVE-2026-13069

Medium · published July 23, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.5th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-23T00:16Z
Affected products (4)
ProductVersionsFixed in
mongodb/mongodb≥ 7.0.0, < 7.0.397.0.39
mongodb/mongodb≥ 8.0.0, < 8.0.288.0.28
mongodb/mongodb≥ 8.2.0, < 8.2.128.2.12
mongodb/mongodb≥ 8.3.0, < 8.3.78.3.7
References (1)
https://jira.mongodb.org/browse/SERVER-127566 · [email protected]
EPSS history
Timeline
  • 22 JUL 19:15Z
    Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion
    cvelistv5