Denial of service via $linearFill window function in MongoDB (CVE-2026-13065)

A read-only user can craft an aggregation pipeline using the $linearFill window function operator with an expression-based sortBy expression to cause the mongod process to terminate abnormally. This results in a denial of service condition exploitable without write privileges. The root cause is insufficient validation of sort specifications in the $linearFill parser, which fails to reject expression-based sort parts incompatible with linear interpolation. Affected versions: - 8.0.27 We recommend updating to: 8.2.12, 8.0.28, 7.0.39, 8.3.7, 9.1.0-rc0, 9.0.0-rc1. CVSS 7.1 · our assessment: this_week Reference: https://jira.mongodb.org/browse/SERVER-127280 Details: https://vuln.today/cve/CVE-2026-13065