CVE-2026-13071
Received Received - Intake

Memory Corruption in MongoDB via Aggregation Expressions

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13071
EUVD
EUVD-2026-47790

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated user with read access to terminate the mongod process by using specific aggregation expressions that execute server-side JavaScript. The root cause is improper memory handling during document processing.

Detection Guidance

Detection involves monitoring for unexpected mongod process terminations or crashes during aggregation operations. Check MongoDB logs for errors related to JavaScript execution or memory handling. Use system monitoring tools to track process stability during aggregation queries.

Impact Analysis

An attacker could exploit this to crash the MongoDB server, leading to denial of service. This disrupts database operations and may cause data unavailability for legitimate users.

Mitigation Strategies

Apply the latest MongoDB security patch immediately. Restrict read access to trusted users only. Disable server-side JavaScript execution if not required. Monitor for unusual aggregation operations and terminate suspicious queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart