CPU exhaustion via exponential $jsonSchema hashing in MongoDB (CVE-2026-13064)

A flaw in MongoDB's query planning code causes hashing of query solutions involving deeply nested `$jsonSchema` constructs (specifically `InternalSchema*` match expressions) to exhibit exponential time complexity rather than linear. An authenticated user with read access to a collection can trigger multi-minute to multi-hour CPU-bound operations that cannot be interrupted via `killOp()` or other standard administrative controls, posing a denial-of-service risk. Affected versions: - 8.0.27 We recommend updating to: 9.0.0-rc0, 8.2.12, 8.0.28, 8.3.7. CVSS 7.1 · our assessment: this_week Reference: https://jira.mongodb.org/browse/SERVER-125872 Details: https://vuln.today/cve/CVE-2026-13064