Which versions of MongoDB Server are affected by CVE-2026-13075?

MongoDB Server deployments face a denial-of-service vulnerability affecting authenticated users with aggregation query privileges, enabling them to crash the database under memory pressure.. A patch is available.

How to fix or mitigate CVE-2026-13075?

Within 24 hours, conduct a complete inventory of MongoDB Server deployments and identify all users and applications with aggregation query privileges; prioritize instances supporting production workloads. Within 7 days, implement the principle of least privilege by restricting aggregation access to only essential applications and users, deploy MongoDB resource limits configured to constrain aggregation memory consumption (maxMemoryUsageBytes parameter), and enable audit logging for all aggregation operations. Within 30 days, subscribe to MongoDB security advisories for patch notifications, establish a testing plan for deploying patches once vendor releases remediation, and review aggregation privilege assignments quarterly.

MongoDB Server CVE-2026-13075

Q: What is the CVSS score of CVE-2026-13075?

CVE-2026-13075 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-47786 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-22 cna@mongodb.com

Denial Of Service MongoDB

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable and low-complexity, but needs an authenticated account with aggregation rights (PR:L); impact is availability-only (A:H) with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mongodb).

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:36 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.1

DescriptionCVE.org

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

AnalysisAI

Denial of service in MongoDB Server (mongod) allows an authenticated user with aggregation privileges to force the operating system to terminate the mongod process under memory pressure by abusing the $rankFusion and $scoreFusion hybrid-search aggregation stages. The flaw sits in the server's error-handling path and requires only the ability to run aggregation queries, causing an OOM-triggered crash of the database instance. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected components are the $rankFusion and $scoreFusion aggregation stages, which are MongoDB's hybrid-search operators that combine and re-rank results from multiple sub-pipelines (e.g. blending vector/$search and traditional queries via reciprocal rank fusion or score fusion). The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): during error handling within these stages the server allocates or retains memory without an effective bound, so under memory pressure the Linux OOM killer terminates the mongod process. Because the trigger lives in the error-handling path rather than normal execution, the condition is reached when malformed or resource-intensive fusion queries drive the process toward exhaustion.

RemediationAI

Upgrade mongod to the fixed release identified in MongoDB's tracking issue SERVER-128316 (https://jira.mongodb.org/browse/SERVER-128316) - no exact fix version is stated in the available data, so verify the patched build directly from that advisory; no vendor-released patch version is independently confirmed here. As compensating controls until patched, restrict aggregation privileges using role-based access control so that only trusted principals can run pipelines, and specifically avoid granting the ability to execute $rankFusion and $scoreFusion to untrusted or multi-tenant users. Enforce per-operation resource limits and configure appropriate memory/cgroup limits and automatic restart (e.g. systemd Restart=on-failure) so an OOM kill of mongod recovers quickly; note that automatic restart mitigates downtime but does not prevent repeated crash attempts. If hybrid search is unused, denying access to these stages via least-privilege roles removes the attack surface with no functional loss.