medium6.5
CVE-2026-13069
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payloa…
Impact
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | Mongodb | from 7.0.0 before 7.0.39 from 8.0.0 before 8.0.28 from 8.2.0 before 8.2.12 from 8.3.0 before 8.3.7 |