CVE-2026-13056

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in MongoDB Server via Large Array Queries

Publication date: 2026-07-22

Last updated on: 2026-08-05

Assigner: MongoDB, Inc.

Description

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-05

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13056

EUVD

EUVD-2026-47779

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 8.0.0 (inc) to 8.0.28 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1325	The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to craft a query that generates large arrays, creating very large intermediate objects in memory. This can cause the server to crash due to an out-of-memory (OOM) error.

Detection Guidance

This vulnerability involves large array expressions causing server crashes due to high memory usage. Detection requires monitoring for unexpected memory spikes or crashes in applications using query engines. Check server logs for out-of-memory errors and use system monitoring tools like top, htop, or ps to observe memory consumption during query execution.

Impact Analysis

The impact includes server crashes, leading to denial of service. Attackers could exploit this to disrupt services, cause downtime, or force system resets.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by causing service disruptions due to server crashes from OOM errors. GDPR requires data availability and integrity, while HIPAA mandates reliable access to protected health information. Frequent crashes may lead to unauthorized access risks or data processing interruptions, potentially violating these standards.

Mitigation Strategies

Immediate mitigation includes limiting query complexity by restricting large array expressions in user inputs. Implement input validation to reject excessively large or complex queries. Update to the latest patched version of the affected software if available. Monitor memory usage and set resource limits to prevent crashes.

Hi! I’m here to help you understand CVE-2026-13056. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70