CVE-2026-13064
Received Received - Intake

MongoDB CPU Exhaustion via Nested $jsonSchema Queries

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13064
EUVD
EUVD-2026-47797

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves MongoDB deployments where certain query operations with deeply nested $jsonSchema constructs consume excessive CPU resources. The issue leads to resource exhaustion as the CPU-bound operation cannot be stopped by standard admin controls.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal CPU usage during MongoDB query operations, particularly those involving $jsonSchema. Check MongoDB logs for queries with deeply nested $jsonSchema constructs and measure CPU consumption during such operations.

Impact Analysis

The vulnerability can cause system slowdowns or crashes due to high CPU usage, potentially disrupting database services and affecting performance for all users relying on the affected MongoDB deployment.

Mitigation Strategies

Immediately restrict access to MongoDB deployments to trusted users only. Update MongoDB to the latest patched version. Disable or limit the use of $jsonSchema in queries until a fix is applied. Monitor CPU usage closely for signs of resource exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13064. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart