CVE-2026-13070: Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable OCSP stapling validation for outgoing TLS connections (OCSP stapling validation is enabled by default for outgoing TLS connections per the provided text) to avoid process termination when processing malformed OCSP responses during the TLS handshake.
MongoDB (outgoing TLS OCSP stapling validation) OCSP stapling validation (outgoing TLS) = enabled by default
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13070?
CVE-2026-13070 has a medium severity rating of 5.3.
What type of vulnerability is CVE-2026-13070?
CVE-2026-13070 involves improper validation of OCSP response during an outbound TLS handshake.
How do I fix CVE-2026-13070?
To mitigate CVE-2026-13070, ensure that OCSP stapling validation is properly configured and consider updating to a patched version of MongoDB.
What are the potential impacts of CVE-2026-13070 on MongoDB?
CVE-2026-13070 can lead to abnormal termination of the MongoDB server during TLS handshake due to malformed OCSP responses.
What versions of MongoDB are affected by CVE-2026-13070?
All versions of MongoDB that enable OCSP stapling validation for outgoing TLS connections are potentially affected by CVE-2026-13070.