CVE-2026-13075
An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.
- Score
- CVSS 4.0 7.1 High
- Status
- Analyzed - cna@mongodb.com
- Published
- 2026-07-22
- Last modified
- 2026-10-24
- Weaknesses
- CWE-770
Affected products
References
- https://jira.mongodb.org/browse/SERVER-128316
