Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-13063

libmongocrypt Improper Input Validation Leading to Process Termination

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.2.0 to < 8.2.12affected
  • 8.3.0 to < 8.3.7affected

References