CVE-2026-13075: 
MongoDB Analisi e mitigazione delle vulnerabilità

CVE-2026-13075 is a Denial of Service vulnerability in MongoDB Server affecting the $rankFusion and $scoreFusion aggregation stages. An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure by exploiting a flaw in the server's error-handling path. Affected versions include MongoDB Server 8.2.0 through 8.2.11 and 8.3.0 through 8.3.6. The vulnerability was published on July 22, 2026, with a patch available the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the server's error-handling path within the $rankFusion and $scoreFusion aggregation stages fails to properly constrain memory allocation under pressure conditions. An attacker with low-privileged network access who can execute aggregation queries can trigger this code path, causing the operating system to terminate the mongod process due to memory exhaustion. No special configuration or user interaction is required beyond having valid credentials and aggregation query permissions (GitHub Advisory, MongoDB JIRA).

Successful exploitation results in a complete loss of availability for the affected MongoDB instance, as the mongod process is forcibly terminated by the OS. There is no impact on confidentiality or data integrity. Depending on deployment architecture, a crashed mongod process could disrupt dependent applications and services until the process is restarted, and in replica set or sharded cluster configurations, repeated exploitation could destabilize the broader database infrastructure (GitHub Advisory).

1. Obtain credentials: Acquire valid MongoDB credentials for an account with at least the ability to run aggregation queries (e.g., a low-privileged application user or a free-tier account).
2. Connect to the target: Establish a connection to the vulnerable MongoDB Server instance (versions 8.2.0–8.2.11 or 8.3.0–8.3.6) using a MongoDB client or driver.
3. Craft a malicious aggregation query: Construct an aggregation pipeline that invokes the $rankFusion or $scoreFusion stage in a manner that triggers the server's error-handling path under memory pressure conditions.
4. Execute the query: Submit the crafted aggregation query to the target database. The server's error-handling code path allocates resources without proper limits, causing memory exhaustion.
5. Trigger OS termination: Under sufficient memory pressure, the operating system's OOM (Out-Of-Memory) killer terminates the mongod process, resulting in a denial of service (GitHub Advisory, MongoDB JIRA).

• Logs: Unexpected mongod process crash entries in system logs (e.g., /var/log/syslog or /var/log/messages) showing OOM killer termination of the mongod process; MongoDB logs showing aggregation queries involving $rankFusion or $scoreFusion stages immediately preceding a crash.
• Process: Sudden termination of the mongod process without a graceful shutdown signal; repeated restarts of the MongoDB service in a short time window.
• Network: Repeated aggregation query connections from a single authenticated user or IP address targeting the MongoDB port (default 27017) with $rankFusion or $scoreFusion pipeline stages.
• System: OS-level OOM killer events logged in kernel messages (dmesg) referencing the mongod process.

MongoDB has released patched versions: 8.2.12 and 8.3.7, which address this vulnerability. Organizations should upgrade to these versions as the primary remediation (GitHub Advisory). As a temporary workaround if patching cannot be immediately deployed, restrict aggregation query permissions to only trusted users and monitor for unexpected mongod process crashes. Additionally, implementing OS-level memory limits and alerting on OOM events can help reduce the impact of exploitation attempts.