Which versions of MongoDB are affected by EUVD-2026-47797?

MongoDB deployments face uncontrolled denial-of-service risk through a query processing flaw that allows authenticated users to exhaust server CPU with no recovery option via standard administrative…. A patch is available.

How to fix or mitigate EUVD-2026-47797?

Within 24 hours, inventory all MongoDB authenticated user accounts and their query privileges, then implement network access controls to limit which systems and IP ranges can submit queries to production databases. Within 7 days, disable $jsonSchema validation in applications where operationally feasible, deploy query execution timeouts at the application layer, and enable CPU and memory monitoring with alerts on all MongoDB instances. Within 30 days, establish a query complexity assessment process before production deployment, implement per-user rate limiting for resource-intensive queries, and monitor MongoDB advisory SERVER-125872 regularly for patch availability; initiate upgrade testing immediately upon patch release.

MongoDB EUVD-2026-47797

Q: What is the CVSS score of EUVD-2026-47797?

EUVD-2026-47797 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-13064 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-07-22 cna@mongodb.com

Denial Of Service MongoDB

7.1

CVSS 4.0 · Vendor: mongodb

Severity by source

Vendor (mongodb) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (mongodb) · only source for this CVE.

CVSS VectorVendor: mongodb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 22, 2026 - 21:03 EUVD

Analysis Generated

Jul 22, 2026 - 20:33 vuln.today

CVE Published

Jul 22, 2026 - 20:16 cve.org

HIGH 7.1

DescriptionCVE.org

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

AnalysisAI

Denial of service in MongoDB allows an authenticated attacker to exhaust server CPU by submitting query operations that use deeply nested $jsonSchema validation constructs, producing a runaway CPU-bound operation that cannot be halted via standard administrative controls such as killOp. Reported by MongoDB's own CNA (SERVER-125872) and classified as inefficient algorithmic complexity (CWE-407), with no public exploit identified at time of analysis. The inability to interrupt the operation elevates this above a routine resource-consumption bug because normal recovery tooling is ineffective.