CVE-2026-13055

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13055
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13055.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13055
Aliases
Downstream
Published
2026-07-22T19:22:54Z
Modified
2026-08-17T08:11:03Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A CVSS Calculator
Summary
Server crash via aggregation pipeline expression with compound wildcard index specification
Details

The $_internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

Database specific 
{
    "cna_assigner": "mongodb",
    "cwe_ids": [
        "CWE-617"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13055.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.0.39"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.0.28"
                },
                {
                    "introduced": "8.2.0"
                },
                {
                    "fixed": "8.2.12"
                },
                {
                    "introduced": "8.3.0"
                },
                {
                    "fixed": "8.3.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo
Events
Introduced
37d84072b5c5b9fd723db5fa133fb202ad2317f1
Fixed
0c0ddf9b45db1492d57cef505c547f3a954a0c80
Introduced
b41cda4fe697dce6fd9b83b3805362ccc02fbeb3
Fixed
dc5344b376fdfab0fe5b2982f125c056ab0abcd8
Introduced
b993867dce63dd366cd93e60f3f425ed716f6497
Fixed
10d50f5046de5c76a9d869823219134b3596905a
Introduced
0f29b043a58fdd251ce0a0b32754b8459613c933
Fixed
527067edda13efcac3d257b3cdb1c510c57b3c6e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.39"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.28"
        },
        {
            "introduced": "8.2.0"
        },
        {
            "fixed": "8.2.12"
        },
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.3.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

r7.*
r7.0.0
r7.0.1
r7.0.1-rc0
r7.0.10
r7.0.10-rc0
r7.0.11
r7.0.11-rc0
r7.0.11-rc1
r7.0.11-rc2
r7.0.12
r7.0.12-rc0
r7.0.12-rc1
r7.0.13
r7.0.13-rc0
r7.0.13-rc1
r7.0.14
r7.0.14-rc0
r7.0.15
r7.0.15-rc0
r7.0.15-rc1
r7.0.16
r7.0.16-rc0
r7.0.16-rc1
r7.0.17
r7.0.18
r7.0.2
r7.0.2-rc0
r7.0.2-rc1
r7.0.2-rc2
r7.0.21
r7.0.21-alpha0
r7.0.21-rc0
r7.0.22
r7.0.22-rc0
r7.0.23
r7.0.23-rc0
r7.0.23-rc1
r7.0.24
r7.0.24-rc0
r7.0.25-alpha0
r7.0.26
r7.0.26-rc0
r7.0.27
r7.0.27-alpha0
r7.0.27-rc0
r7.0.3
r7.0.3-rc0
r7.0.3-rc1
r7.0.35
r7.0.4
r7.0.4-rc0
r7.0.5
r7.0.5-rc0
r7.0.6
r7.0.6-rc0
r7.0.7
r7.0.7-rc0
r7.0.7-rc1
r7.0.7-rc2
r7.0.8
r7.0.8-rc0
r7.0.9
r7.0.9-rc0
r7.0.9-rc1
r8.*
r8.0.0
r8.0.1
r8.0.1-rc0
r8.0.10
r8.0.10-rc0
r8.0.12
r8.0.12-rc0
r8.0.13
r8.0.13-rc0
r8.0.13-rc1
r8.0.13-rc2
r8.0.14
r8.0.14-rc0
r8.0.14-rc1
r8.0.16
r8.0.16-rc0
r8.0.16-rc1
r8.0.17-alpha0
r8.0.2
r8.0.24
r8.0.3
r8.0.4
r8.0.4-rc0
r8.0.5
r8.0.5-rc0
r8.0.5-rc1
r8.0.5-rc2
r8.0.6
r8.2.0
r8.2.1
r8.2.1-rc0
r8.2.1-rc1
r8.2.10
r8.2.2
r8.2.2-rc0
r8.2.3-alpha0
r8.2.4-alpha0
r8.2.4-alpha1
r8.3.0
r8.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13055.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195283451325379709791176466181059330449",
                "11934503373533753673416013101293166641",
                "34761259574797342523983725962110135860",
                "6697845561671035843872382804131271398",
                "190799824288394015190372324041271803151"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-13055-18a7c7d6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/10d50f5046de5c76a9d869823219134b3596905a",
        "target": {
            "file": "src/mongo/db/pipeline/javascript_execution.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "139145742414386593281199011500928031122",
            "length": 419
        },
        "id": "CVE-2026-13055-309120cf",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/10d50f5046de5c76a9d869823219134b3596905a",
        "target": {
            "file": "src/mongo/db/pipeline/javascript_execution.cpp",
            "function": "JsExecution::callFunction"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "235349502426767986109171624443399362060",
                "332118117976299452680602889698335846937",
                "273414055616980281623380822972213976202",
                "260359270913691981069265618939534968152",
                "92760588891291927255272146911062451930",
                "131421526859279654507125979858138582212"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-13055-cb3d2fa4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/10d50f5046de5c76a9d869823219134b3596905a",
        "target": {
            "file": "src/mongo/scripting/mozjs/objectwrapper.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "39839291339635135228351456498984914983",
                "35727036334983502474101853618146564071",
                "152433407413412697966849125832082995516"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-13055-e13fbe7c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/10d50f5046de5c76a9d869823219134b3596905a",
        "target": {
            "file": "src/mongo/db/pipeline/expression_javascript_test.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "284447201108016139902358258055612064237",
            "length": 1418
        },
        "id": "CVE-2026-13055-e30fe2e5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/mongodb/mongo/commit/10d50f5046de5c76a9d869823219134b3596905a",
        "target": {
            "file": "src/mongo/scripting/mozjs/objectwrapper.cpp",
            "function": "ObjectWrapper::toBSON"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:31:19Z"