CVE-2026-13071 — Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination

CVE-2026-13071

Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination PUBLISHED

Description (CNA)

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 7.0 before 7.0.39; affected 8.0 before 8.0.28; affected 8.2.0 before 8.2.12; affected 8.3.0 before 8.3.7

CWE

CWE-416

References

https://jira.mongodb.org/browse/SERVER-128473

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.