CVE-2026-13056: A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM
Published Jul 22, 2026
·Updated
Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.
Affected Software
2 affected components
MongoDB MongoDB>=8.0.0<8.0.28
MongoDB MongoDB>=8.3.0<8.3.7
Event History
Jul 22, 2026
CVE Published
via MITRE·07:22 PM
Data Sourced
via MITRE·07:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-13056?
The severity of CVE-2026-13056 is medium with a score of 6.5.
2
How does CVE-2026-13056 affect the system?
CVE-2026-13056 allows a user with read access to execute a crafted query that can lead to a Denial of Service by consuming excessive RAM.
3
What can I do to mitigate CVE-2026-13056?
To mitigate CVE-2026-13056, limit user permissions and monitor query performance to prevent excessive resource consumption.
4
Who is affected by CVE-2026-13056?
Any system using the affected database version with users having read access may be vulnerable to CVE-2026-13056.
5
What type of attack is enabled by CVE-2026-13056?
CVE-2026-13056 enables a Denial of Service (DoS) attack due to excessive memory consumption.