CVE-2026-13075
Received Received - Intake

Memory Corruption in MongoDB via Aggregation Stages

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: MongoDB, Inc.

Description
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-13075
EUVD
EUVD-2026-47786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated user to terminate the mongod process by triggering memory pressure through specific aggregation stages called $rankFusion and $scoreFusion. The issue occurs in the server's error-handling path and requires the attacker to have the ability to run aggregation queries.

Detection Guidance

This vulnerability can be detected by monitoring for crashes in the mongod process during aggregation queries using $rankFusion or $scoreFusion stages. Check system logs for mongod process terminations and review aggregation query logs for these specific stages.

Impact Analysis

An attacker with authenticated access could crash the MongoDB server, leading to denial of service. This disrupts database operations, potentially causing data unavailability or application failures.

Mitigation Strategies

Apply the latest MongoDB security patch immediately. Restrict authenticated user access to aggregation operations until patched. Monitor for unusual aggregation queries and terminate suspicious sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart