CVE-2026-13075: 
MongoDB Schwachstellenanalyse und -minderung

CVE-2026-13075 is a Denial of Service vulnerability in MongoDB Server affecting the $rankFusion and $scoreFusion aggregation stages. An authenticated user can trigger the mongod process to be terminated by the operating system under memory pressure by exploiting a flaw in the server's error-handling path. Affected versions include MongoDB Server 8.2.0 through 8.2.11 and 8.3.0 through 8.3.6. It was published on July 22, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the server's error-handling path within the $rankFusion and $scoreFusion aggregation stages fails to properly constrain memory allocation under pressure conditions. An attacker with network access and low-privilege credentials (sufficient to run aggregation queries) can craft aggregation pipeline queries targeting these stages, causing uncontrolled memory consumption that leads the OS to terminate the mongod process via OOM (Out-of-Memory) killing. No special configuration or user interaction is required beyond the ability to execute aggregation queries. The vulnerability is tracked upstream in MongoDB's issue tracker as SERVER-128316 (GitHub Advisory, MongoDB Jira).

Successful exploitation results in a complete availability loss of the MongoDB database service, as the mongod process is forcibly terminated by the operating system. There is no impact on confidentiality or data integrity — the vulnerability is purely a Denial of Service. Any application or service dependent on the affected MongoDB instance would experience an outage until the process is restarted, and repeated exploitation could prevent sustained database availability (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.41% (0.235% per GitHub Advisory), placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, reflecting the requirement for authenticated access (GitHub Advisory).

1. Obtain Credentials: Acquire valid MongoDB credentials with at least low-privilege access sufficient to run aggregation queries on the target instance (e.g., a user with find and aggregate privileges on a database).
2. Identify Vulnerable Version: Confirm the target is running MongoDB Server 8.2.0–8.2.11 or 8.3.0–8.3.6 using connection metadata or version query (db.version()).
3. Craft Malicious Aggregation Query: Construct an aggregation pipeline using the $rankFusion or $scoreFusion stage designed to trigger the error-handling path under memory pressure conditions.
4. Execute Query Repeatedly or at Scale: Submit the crafted aggregation query — potentially multiple times or with large data inputs — to exhaust available memory on the server, triggering the OS OOM killer to terminate the mongod process.
5. Achieve Denial of Service: The mongod process is killed, causing a database outage for all connected clients until the service is manually or automatically restarted (GitHub Advisory, MongoDB Jira).

• Logs: Sudden mongod process termination entries in system logs (e.g., /var/log/syslog or /var/log/messages) with OOM killer messages referencing the mongod process; MongoDB logs showing aggregation queries involving $rankFusion or $scoreFusion stages immediately before the crash.
• Process: Unexpected termination of the mongod process; repeated mongod restarts in a short time window as recorded by process supervisors (e.g., systemd, init).
• Network: Repeated aggregation query connections from a single authenticated user or IP address targeting the MongoDB port (default 27017) in a short timeframe.
• System: OS-level OOM kill events visible via dmesg output referencing mongod; elevated memory usage on the MongoDB host preceding the crash.

MongoDB has released patched versions addressing this vulnerability: 8.2.12 and 8.3.7. Users should upgrade to these versions as the primary remediation. As an interim workaround if patching cannot be immediately deployed, restrict aggregation query permissions to only trusted users by reviewing and tightening MongoDB role assignments. Additionally, implementing OS-level memory limits (e.g., via cgroups or ulimit) for the mongod process can reduce the impact of memory exhaustion. Monitoring for unexpected mongod process crashes and alerting on OOM events is also recommended (GitHub Advisory, MongoDB Jira).

Coverage of CVE-2026-13075 has been limited to automated vulnerability tracking platforms and security aggregators. BeyondMachines noted it as part of a broader MongoDB patch release addressing 26 vulnerabilities, including a critical memory corruption flaw. No significant independent researcher commentary or social media discussion has been identified at this time (BeyondMachines).