CVE-2026-13064: CWE-407: Inefficient Algorithmic Complexity in MongoDB MongoDB Server
CVE-2026-13064 is a high-severity vulnerability in MongoDB Server where certain query operations using deeply nested $jsonSchema constructs cause excessive CPU consumption. This can lead to resource exhaustion, and the CPU-bound operation cannot be interrupted by standard administrative controls. The affected versions include 8.0, 8.2.0, and 8.3.0. No official patch or remediation has been confirmed yet.
AI Analysis
Technical Summary
This vulnerability involves inefficient algorithmic complexity (CWE-407) in MongoDB Server's handling of deeply nested $jsonSchema queries. Such queries can trigger disproportionate CPU usage, potentially exhausting system resources. The CPU-bound operations resulting from exploitation cannot be interrupted by normal administrative means, increasing the risk of denial of service. The issue affects specific MongoDB Server versions 8.0, 8.2.0, and 8.3.0. There is currently no vendor advisory indicating an available patch or fix.
Potential Impact
Exploitation of this vulnerability can cause high CPU consumption leading to resource exhaustion on affected MongoDB Server instances. This may degrade performance or cause denial of service conditions. The inability to interrupt the CPU-bound operations through standard administrative controls exacerbates the impact, potentially requiring service restarts or other disruptive measures.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting or monitoring the use of deeply nested $jsonSchema queries in MongoDB Server to reduce risk. Avoid running untrusted queries that could trigger this condition.
CVE-2026-13064: CWE-407: Inefficient Algorithmic Complexity in MongoDB MongoDB Server
Description
CVE-2026-13064 is a high-severity vulnerability in MongoDB Server where certain query operations using deeply nested $jsonSchema constructs cause excessive CPU consumption. This can lead to resource exhaustion, and the CPU-bound operation cannot be interrupted by standard administrative controls. The affected versions include 8.0, 8.2.0, and 8.3.0. No official patch or remediation has been confirmed yet.
CVSS v4.0
Score 7.1high
Affected software
pkg:github/mongodb/mongoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves inefficient algorithmic complexity (CWE-407) in MongoDB Server's handling of deeply nested $jsonSchema queries. Such queries can trigger disproportionate CPU usage, potentially exhausting system resources. The CPU-bound operations resulting from exploitation cannot be interrupted by normal administrative means, increasing the risk of denial of service. The issue affects specific MongoDB Server versions 8.0, 8.2.0, and 8.3.0. There is currently no vendor advisory indicating an available patch or fix.
Potential Impact
Exploitation of this vulnerability can cause high CPU consumption leading to resource exhaustion on affected MongoDB Server instances. This may degrade performance or cause denial of service conditions. The inability to interrupt the CPU-bound operations through standard administrative controls exacerbates the impact, potentially requiring service restarts or other disruptive measures.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting or monitoring the use of deeply nested $jsonSchema queries in MongoDB Server to reduce risk. Avoid running untrusted queries that could trigger this condition.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-06-23T18:00:07.375Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a61231e9c2644c7f89b2c94
Added to database: 07/22/2026, 20:07:58 UTC
Last enriched: 07/30/2026, 04:06:10 UTC
Last updated: 09/04/2026, 22:52:09 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.