Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-13075

$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB MongoDB Server

Default version status: unaffected

  • 8.2.0 to < 8.2.12affected
  • 8.3.0 to < 8.3.7affected

References