CVE-2026-13076

An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.

Database specific

{
    "cna_assigner": "mongodb",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13076.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.3.0"
                },
                {
                    "fixed": "8.3.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/mongodb/mongo

Affected ranges

Type

GIT

Repo

https://github.com/mongodb/mongo

Events

Introduced

0f29b043a58fdd251ce0a0b32754b8459613c933

Fixed

527067edda13efcac3d257b3cdb1c510c57b3c6e

Database specific

Show details

{
    "cpe": "cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.3.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

r8.*

r8.3.0

r8.3.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13076.json"