CVE-2026-13065
Received Received - Intake

MongoDB Denial of Service via $linearFill Operator

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13065
EUVD
EUVD-2026-47796

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a user with read-only access to craft a malicious aggregation pipeline using the $linearFill window function operator with a specific sortBy expression. This causes the MongoDB server process to crash abnormally, leading to a denial of service condition.

Impact Analysis

If exploited, this vulnerability can cause your MongoDB server to crash, disrupting database operations and making the system unavailable for all users. It requires only read-only privileges, increasing the risk of unauthorized impact.

Mitigation Strategies

Update MongoDB to the latest patched version immediately to address the insufficient validation of sort specifications during aggregation pipeline execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13065. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart