CVE-2026-13064

Analyzed Analyzed - Analysis Complete

MongoDB CPU Exhaustion via Nested $jsonSchema Queries

Publication date: 2026-07-22

Last updated on: 2026-08-05

Assigner: MongoDB, Inc.

Description

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-08-05

Generated

2026-08-12

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-13064

EUVD

EUVD-2026-47797

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	From 8.0.0 (inc) to 8.0.28 (exc)
mongodb	mongodb	From 8.2.0 (inc) to 8.2.12 (exc)
mongodb	mongodb	From 8.3.0 (inc) to 8.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability involves MongoDB deployments where certain query operations with deeply nested $jsonSchema constructs consume excessive CPU resources. The issue leads to resource exhaustion as the CPU-bound operation cannot be stopped by standard admin controls.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal CPU usage during MongoDB query operations, particularly those involving $jsonSchema. Check MongoDB logs for queries with deeply nested $jsonSchema constructs and measure CPU consumption during such operations.

Impact Analysis

The vulnerability can cause system slowdowns or crashes due to high CPU usage, potentially disrupting database services and affecting performance for all users relying on the affected MongoDB deployment.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing resource exhaustion through CPU-bound operations. GDPR requires data protection and availability, while HIPAA mandates safeguards for protected health information. Uncontrolled CPU consumption may lead to service disruptions, potentially violating availability requirements under these regulations.

Mitigation Strategies

Immediately restrict access to MongoDB deployments to trusted users only. Update MongoDB to the latest patched version. Disable or limit the use of $jsonSchema in queries until a fix is applied. Monitor CPU usage closely for signs of resource exhaustion.

Hi! I’m here to help you understand CVE-2026-13064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70