This vulnerability (CVE-2026-13069) in MongoDB Server involves improper resource allocation controls (CWE-770). An authenticated attacker can exploit an unvalidated field in a Queryable Encryption find payload to cause excessive CPU consumption or out-of-memory conditions by manipulating an internal computation loop. This results in resource exhaustion that degrades the availability of the MongoDB server for other operations. The CVSS 4.0 base score is 7.1, indicating high severity. Affected versions explicitly include 7.0, 8.0, 8.2.0, and 8.3.0. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated user to cause denial of service conditions on the MongoDB server by exhausting CPU and memory resources. This degrades the availability of the database service for legitimate users and operations. There is no indication of data confidentiality or integrity impact from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to authenticated users and monitor resource usage to detect potential exploitation attempts. Avoid exposing MongoDB servers to untrusted users. No official fix or temporary workaround has been published by MongoDB at this time.