CVE-2026-13073 — MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

CVE-2026-13073

MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination PUBLISHED

Description (CNA)

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.0 before 8.0.28

CWE

CWE-617

References

https://jira.mongodb.org/browse/SERVER-128512

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.