CVE-2026-13056
Received Received - Intake

Memory Exhaustion in MongoDB Server via Large Array Queries

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13056
EUVD
EUVD-2026-47779

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1325 The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to craft a query that generates large arrays, creating very large intermediate objects in memory. This can cause the server to crash due to an out-of-memory (OOM) error.

Detection Guidance

This vulnerability involves large array expressions causing server crashes due to high memory usage. Detection requires monitoring for unexpected memory spikes or crashes in applications using query engines. Check server logs for out-of-memory errors and use system monitoring tools like top, htop, or ps to observe memory consumption during query execution.

Impact Analysis

The impact includes server crashes, leading to denial of service. Attackers could exploit this to disrupt services, cause downtime, or force system resets.

Mitigation Strategies

Immediate mitigation includes limiting query complexity by restricting large array expressions in user inputs. Implement input validation to reject excessively large or complex queries. Update to the latest patched version of the affected software if available. Monitor memory usage and set resource limits to prevent crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart