CVE-2026-13056: Memory Exhaustion DOS Vulnerability

CVE-2026-13056 Overview

CVE-2026-13056 is a memory exhaustion vulnerability affecting MongoDB Server. Attackers can craft queries using expressions that generate large arrays, producing very large intermediate objects in server memory. The condition causes the server process to crash with an out-of-memory (OOM) error, resulting in denial of service.

The flaw is tracked under CWE-1325, which covers improperly controlled sequential memory allocation. Exploitation requires network access and low-privilege authentication, but no user interaction. Successful attacks impact availability while leaving confidentiality and integrity intact.

Critical Impact
An authenticated attacker can crash the MongoDB server process by submitting a single crafted aggregation query, causing service disruption for all connected clients.

Affected Products

MongoDB Server (see the MongoDB Server Issue Tracker for affected versions)
Deployments that permit authenticated clients to execute aggregation expressions
Self-managed and cloud-hosted MongoDB instances exposed to authenticated tenants

Discovery Timeline

2026-07-22 - CVE-2026-13056 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13056

Vulnerability Analysis

The vulnerability resides in how MongoDB Server evaluates aggregation expressions that produce arrays. Certain expressions can be composed to generate arrays whose size grows disproportionately to the input query. During evaluation, the server materializes these arrays as intermediate objects in memory before the pipeline stage completes.

Because the allocation is not bounded by a resource ceiling proportional to expected query cost, a small request payload can force allocation of extremely large in-memory structures. The mongod process consumes available memory until the operating system terminates it with an OOM condition, or the process aborts internally.

The issue is categorized under [CWE-1325], improperly controlled sequential memory allocation. Impact is limited to availability, as the crash does not disclose data or permit code execution.

Root Cause

The root cause is missing size validation on intermediate results produced by array-generating expressions inside the aggregation framework. The evaluator allows expression outputs to expand without enforcing a memory budget, so recursive or multiplicative array constructs can be chained to produce oversized objects during a single query execution.

Attack Vector

An attacker with valid credentials submits an aggregation query over the network. The query uses expressions that expand into very large arrays through composition, repetition, or multiplication of array-producing operators. When the server evaluates the pipeline, memory allocation grows until the process crashes. Repeated submissions can prevent the server from returning to service.

No verified proof-of-concept code has been published. See the MongoDB Server Issue Tracker for technical details maintained by the vendor.

Detection Methods for CVE-2026-13056

Indicators of Compromise

mongod process termination events accompanied by kernel OOM killer entries in /var/log/messages or dmesg output.
Sudden spikes in resident set size (RSS) for the mongod process immediately before a crash.
Aggregation queries in the profiler or slow query log that reference expressions producing large arrays, such as chained $range, $map, or $reduce operators.
Repeated client reconnections following abrupt server unavailability.

Detection Strategies

Enable the MongoDB database profiler at level 1 or 2 and alert on aggregation operations with high docsExamined or long millis values before termination.
Correlate host-level memory pressure metrics with MongoDB query logs to identify the query preceding a crash.
Baseline expected aggregation memory usage and alert on outliers exceeding the normal maximum.

Monitoring Recommendations

Ship MongoDB logs and host telemetry into a centralized analytics platform to correlate OOM events with client identities and query text.
Monitor authenticated client behavior for repeated aggregation queries against the same collection following a service restart.
Track serverStatus metrics for mem.resident and metrics.aggStageCounters to detect abnormal aggregation load.

How to Mitigate CVE-2026-13056

Immediate Actions Required

Consult the MongoDB Server Issue Tracker entry SERVER-124355 for the list of fixed versions and upgrade guidance.
Upgrade mongod instances to a patched release as soon as maintenance windows allow.
Review database role assignments and remove aggregation privileges from accounts that do not require them.

Patch Information

MongoDB tracks the fix under ticket SERVER-124355. Refer to the MongoDB Server Issue Tracker for the specific server versions that contain the corrected memory handling for array-generating expressions.

Workarounds

Restrict network exposure of MongoDB endpoints to trusted application tiers only.
Enforce least-privilege authentication and revoke query rights for untrusted or multi-tenant users where possible.
Set operating system limits (ulimit, cgroups memory limits) on the mongod process so that a crash impacts only the database service rather than the entire host.
Configure cursor.maxTimeMS and application-side query validation to reject aggregation pipelines with excessive expression nesting.

bash

# Example: limit mongod memory via systemd to contain OOM impact
# /etc/systemd/system/mongod.service.d/override.conf
[Service]
MemoryMax=8G
MemoryHigh=6G

# Apply the override
sudo systemctl daemon-reload
sudo systemctl restart mongod