CVE-2026-13064: MongoDB Denial of Service Vulnerability

CVE-2026-13064 Overview

CVE-2026-13064 is a resource exhaustion vulnerability affecting MongoDB deployments. Query operations that include deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption. The condition leads to a CPU-bound state that administrators cannot interrupt through standard controls such as killOp.

The flaw is categorized under [CWE-407: Inefficient Algorithmic Complexity]. An authenticated attacker with query privileges can submit crafted schema validation requests over the network. Repeated exploitation degrades database availability for legitimate workloads.

Critical Impact

Authenticated remote attackers can exhaust CPU resources on MongoDB servers, causing denial of service against database availability without triggering interruptible operations.

Affected Products

• MongoDB Server deployments processing $jsonSchema query operators
• Refer to MongoDB Jira Issue SERVER-125872 for specific version boundaries

Discovery Timeline

• 2026-07-22 - CVE-2026-13064 published to NVD
• 2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13064

Vulnerability Analysis

The vulnerability resides in MongoDB's handling of $jsonSchema validation expressions during query processing. When a query contains schema constructs nested to significant depth, the server's evaluation logic performs work that scales disproportionately with input structure. This algorithmic complexity issue produces sustained CPU load on the query-serving process.

Once evaluation begins, the operation runs to completion in a tight CPU-bound path. Standard administrative controls such as db.killOp() and query timeouts cannot preempt the work. Operators observing high load cannot recover the affected thread without restarting the mongod process.

Exploitation requires authenticated access with query privileges on a target collection. The attack vector is network-based and requires low complexity. Impact is limited to availability, with no direct effect on data confidentiality or integrity.

Root Cause

The underlying defect is inefficient algorithmic handling of nested $jsonSchema structures during query planning or execution. Input validation does not bound schema nesting depth or reject constructs that would produce excessive computational work. The tracking record for this issue is MongoDB Jira Issue SERVER-125872.

Attack Vector

An attacker with valid database credentials submits a find, aggregate, or similar operation containing a deeply nested $jsonSchema clause. Public exploit code is not currently available. The query begins execution and consumes a CPU core continuously. Repeated submissions across connections can saturate all available cores on the database host.

Because killOp does not interrupt the operation, response requires terminating the process. In replica set or sharded deployments, cascading load can affect secondaries and routers that receive similar workloads.

Detection Methods for CVE-2026-13064

Indicators of Compromise

• Long-running operations in db.currentOp() output containing $jsonSchema predicates that do not respond to killOp
• Sustained high CPU utilization on mongod processes with no corresponding rise in I/O or network throughput
• MongoDB slow query log entries referencing $jsonSchema with elapsed times far exceeding typical query latency

Detection Strategies

• Inspect MongoDB profiler and audit logs for query operators containing $jsonSchema with nested structures beyond application norms
• Correlate authenticated user sessions with operations that generate abnormal CPU-per-query ratios
• Baseline expected query shapes for each application role and alert on deviations that introduce schema validation operators

Monitoring Recommendations

• Enable MongoDB database profiling at level 1 or 2 to capture slow operations and their query predicates
• Forward mongod audit logs and system-level CPU metrics to a centralized analytics platform for correlation
• Alert when db.currentOp() reports operations exceeding a fixed CPU-time threshold that also match $jsonSchema patterns

How to Mitigate CVE-2026-13064

Immediate Actions Required

• Review the MongoDB Jira Issue SERVER-125872 tracker for fixed version information and apply vendor-supplied updates
• Audit database roles and remove query privileges from accounts that do not require ad hoc query access
• Enforce network segmentation so that mongod listeners are reachable only from trusted application tiers

Patch Information

MongoDB tracks remediation under MongoDB Jira Issue SERVER-125872. Administrators should consult that record and official MongoDB release notes to identify patched builds for their deployment channel and apply upgrades during scheduled maintenance windows.

Workarounds

• Restrict use of the $jsonSchema operator to trusted internal roles through custom role definitions where feasible
• Deploy a query proxy or application-layer filter that rejects incoming operations containing $jsonSchema beyond a defined nesting depth
• Enforce per-user connection and operation quotas to limit the blast radius of an authenticated abuse attempt

# Example: restrict find/aggregate on a collection to a dedicated role
use admin
db.createRole({
  role: "appReadNoSchema",
  privileges: [
    { resource: { db: "appdb", collection: "orders" },
      actions: [ "find" ] }
  ],
  roles: []
})

# Assign the least-privileged role to application users
db.grantRolesToUser("app_user", [ { role: "appReadNoSchema", db: "admin" } ])