This vulnerability (CVE-2026-13064) affects MongoDB Server and arises from inefficient algorithmic complexity in processing queries with deeply nested $jsonSchema constructs. Such queries cause excessive CPU usage disproportionate to the workload, potentially exhausting system resources. The CPU-bound state resulting from exploitation cannot be interrupted through normal administrative means, increasing the risk of denial-of-service conditions. The affected versions explicitly include 8.0, 8.2.0, and 8.3.0. No official remediation or patch is currently documented, and no known exploits in the wild have been reported.

Exploitation of this vulnerability can cause high CPU consumption leading to resource exhaustion on affected MongoDB deployments. The CPU-bound operations triggered by malicious queries cannot be interrupted by standard administrative controls, potentially resulting in denial-of-service conditions that degrade database availability and performance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using deeply nested $jsonSchema constructs in queries or limit query complexity to reduce risk. Monitor MongoDB server performance for unusual CPU usage patterns related to query execution.