CVE-2026-13065 — MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

CVE-2026-13065

MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination PUBLISHED

Description (CNA)

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 7.0 before 7.0.39; affected 8.0 before 8.0.28; affected 8.2.0 before 8.2.12; affected 8.3.0 before 8.3.7

CWE

CWE-476

References

https://jira.mongodb.org/browse/SERVER-127280

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.