What is CVE-2026-13074?

CVE-2026-13074 is a medium-severity vulnerability in Mongodb Server, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2026-07-22.

How severe is CVE-2026-13074?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Resource exhaustion in Mongodb Server

CVE-2026-13074

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a…

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Mongodb Server — versions 7.0, 8.0, 8.2.0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

cna@mongodb.com

Frequently asked questions

What is CVE-2026-13074?: CVE-2026-13074 is a medium-severity vulnerability in Mongodb Server, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2026-07-22.
How severe is CVE-2026-13074?: Medium severity. CVSS v3 base score is 5.3 out of 10.