Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-13069

Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 7.0 to < 7.0.39affected
  • 8.0 to < 8.0.28affected
  • 8.2.0 to < 8.2.12affected
  • 8.3.0 to < 8.3.7affected

References