This vulnerability (CVE-2026-13075) affects MongoDB Server versions 8.2.0 and 8.3.0. It involves CWE-770, where the server allocates resources without limits or throttling, specifically in the error-handling path of the $rankFusion and $scoreFusion aggregation stages. An authenticated user capable of running aggregation queries can exploit this to cause the mongod process to be terminated by the operating system under memory pressure. The CVSS 4.0 base score is 7.1, indicating a high severity impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild. The vulnerability requires authenticated access and privileges to run aggregation queries.

Successful exploitation allows an authenticated user to cause a denial of service by terminating the mongod process through excessive memory consumption triggered by specific aggregation stages. This can disrupt database availability and potentially impact dependent applications or services. There is no indication of data confidentiality or integrity compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict aggregation query permissions to trusted users only and monitor for unusual aggregation query patterns involving $rankFusion and $scoreFusion stages. No official remediation or temporary fix has been published by MongoDB at this time.