Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-13056

A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.0 to < 8.0.28affected
  • 8.3.0 to < 8.3.7affected

References