CVE-2026-13069: Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion
An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13069?
CVE-2026-13069 has a medium severity rating of 6.5.
How do I fix CVE-2026-13069?
To mitigate CVE-2026-13069, ensure that all input fields in Queryable Encryption find payloads are properly validated.
What are the risks associated with CVE-2026-13069?
The risks include excessive CPU consumption or out-of-memory conditions on a MongoDB server, leading to degraded availability.
Who is affected by CVE-2026-13069?
Authenticated users of the MongoDB Queryable Encryption (FLE2) feature are affected by CVE-2026-13069.
What type of vulnerability is CVE-2026-13069?
CVE-2026-13069 is a resource exhaustion vulnerability stemming from a lack of input validation.