CVE-2026-13071: Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination
Published Jul 22, 2026
·Updated
An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.
Affected Software
4 affected components
MongoDB MongoDB>=7.0.0<7.0.39
MongoDB MongoDB>=8.0.0<8.0.28
MongoDB MongoDB>=8.2.0<8.2.12
MongoDB MongoDB>=8.3.0<8.3.7
Remediation
Patch Available
Event History
Jul 22, 2026
CVE Published
via MITRE·07:14 PM
Data Sourced
via MITRE·07:14 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-13071?
The severity of CVE-2026-13071 is classified as medium with a score of 6.5.
2
How do I fix CVE-2026-13071?
To mitigate CVE-2026-13071, ensure that your MongoDB installation is updated to the latest version that addresses this memory safety issue.
3
What does CVE-2026-13071 exploit?
CVE-2026-13071 exploits improper memory handling in server-side JavaScript during certain aggregation expressions.
4
Who is vulnerable to CVE-2026-13071?
Authenticated users with read access are vulnerable to CVE-2026-13071.
5
What could happen if CVE-2026-13071 is exploited?
If CVE-2026-13071 is exploited, it can lead to the termination of the mongod process.