CVE-2026-13064 — MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service

CVE-2026-13064

MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service PUBLISHED

Description (CNA)

Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.0 before 8.0.28; affected 8.2.0 before 8.2.12; affected 8.3.0 before 8.3.7

CWE

CWE-407

References

https://jira.mongodb.org/browse/SERVER-125872

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.