Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-13070

Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 7.0 to < 7.0.39affected
  • 8.0 to < 8.0.28affected
  • 8.2.0 to < 8.2.12affected
  • 8.3.0 to < 8.3.7affected

References