CVE-2026-13076

In MongoDB 2.6, when using 2.4-style users, remote attackers can cause a denial of service by leveraging in-memory database representation when authenticating against a non-existent database.

MongoDB versions 3.4.x before 3.4.10 and 3.5.x-development have a disabled-by-default configuration setting, networkMessageCompressors, which when enabled can be exploited by a malicious attacker to deny service or modify memory.

During query planning in MongoDB, when reading the sort pattern in raw BSONObj form, some places do not explicitly handle the meta expression case. This may lead to incorrect transformations and invariant failure.

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

An authenticated user can cause the mongod process to be terminated by the OS under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

MongoDB is vulnerable to a CPU exhaustion DoS attack. An unauthenticated client can send a specific combination of parameters to the hello command in exhaust mode, causing a response loop that bypasses normal throttling.

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until restart. The issue stems from an internal engine selection inconsistency.

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

An authenticated user with read access can cause the mongod process to be terminated by the OS under memory pressure through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections.