CVE-2026-13074: Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13074?
The severity of CVE-2026-13074 is classified as medium with a score of 5.3.
How do I fix CVE-2026-13074?
To mitigate CVE-2026-13074, restrict access to the awaitable hello command and monitor for unusual CPU consumption.
What is the impact of CVE-2026-13074?
CVE-2026-13074 can lead to denial of service by causing excessive CPU consumption on a MongoDB server.
Who is affected by CVE-2026-13074?
Any MongoDB server that allows unauthenticated remote clients can potentially be affected by CVE-2026-13074.
What type of attack does CVE-2026-13074 demonstrate?
CVE-2026-13074 demonstrates a denial of service attack through a response loop in the MongoDB awaitable hello command.