Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-13058

Transaction Command Insufficient Input Validation Leading to Process Termination

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.0 to < 8.0.28affected
  • 8.2.0 to < 8.2.12affected
  • 8.3.0 to < 8.3.7affected

References