CVE-2026-13075 — $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

CVE-2026-13075

$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation PUBLISHED

Description (CNA)

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

Affected (CNA)

Vendor / product	Versions
MongoDB / MongoDB Server	affected 8.2.0 before 8.2.12; affected 8.3.0 before 8.3.7

CWE

CWE-770

References

https://jira.mongodb.org/browse/SERVER-128316

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.