CVE-2026-13070: MongoDB Server DoS Vulnerability

CVE-2026-13070 Overview

CVE-2026-13070 is a null pointer dereference vulnerability [CWE-476] in MongoDB server. The flaw triggers when the server initiates an outbound Transport Layer Security (TLS) connection and processes a malformed Online Certificate Status Protocol (OCSP) response from a remote peer during the handshake. OCSP stapling validation is enabled by default for outgoing TLS connections, which broadens the attack surface. Exploitation causes the MongoDB server process to terminate abnormally, resulting in denial of service.

Critical Impact
A remote peer holding a certificate issued by the cluster's trusted certificate authority, or an attacker positioned on an untrusted network path, can crash a MongoDB server by returning a malformed OCSP response during TLS handshake.

Affected Products

MongoDB Server (versions with OCSP stapling validation enabled for outgoing TLS connections)
MongoDB deployments configured to initiate outbound TLS connections
MongoDB clusters where peers hold certificates from the cluster's trusted CA

Discovery Timeline

2026-07-22 - CVE-2026-13070 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13070

Vulnerability Analysis

The vulnerability resides in MongoDB's TLS client-side OCSP stapling validation logic. When the server acts as a TLS client and initiates an outbound connection, it validates the OCSP response stapled to the peer's certificate. A malformed OCSP response is not handled defensively, and the server dereferences a null pointer during parsing. The result is an abnormal process termination that disrupts availability of the MongoDB instance.

Because OCSP stapling validation is enabled by default for outgoing connections, the vulnerable code path executes without any special configuration. The attack targets availability only. There is no reported impact to confidentiality or integrity of stored data.

Root Cause

The root cause is a missing null check when parsing OCSP response fields returned by the remote TLS peer. The parsing routine assumes that expected fields exist and are well-formed. A malformed response triggers a null pointer dereference [CWE-476], which crashes the process handling the outbound TLS session.

Attack Vector

The attack requires an adjacent network position or a peer holding a certificate signed by the cluster's trusted certificate authority. Two exploitation scenarios apply. First, a compromised or malicious cluster member with a CA-issued certificate can return the malformed OCSP response during handshake. Second, an attacker on an untrusted network path traversed by the outbound TLS connection can inject or manipulate the OCSP response. In both cases, a single crafted response terminates the MongoDB process.

No public proof-of-concept exploit is available at the time of publication. Technical details are tracked in the MongoDB JIRA Issue SERVER-128362.

Detection Methods for CVE-2026-13070

Indicators of Compromise

Unexpected MongoDB server process crashes or restarts correlated with outbound TLS handshakes
Fatal error entries in MongoDB logs referencing OCSP validation or TLS handshake failures
Repeated abnormal termination of mongod processes following connections to remote peers
Core dumps or segmentation fault records tied to the TLS client code path

Detection Strategies

Monitor MongoDB server logs for fatal termination events immediately after outbound TLS or OCSP messages
Correlate process restart events on database hosts with outbound TLS connection attempts to cluster peers or external endpoints
Inspect network traffic for OCSP responses that violate RFC 6960 structure returned to MongoDB hosts
Alert on repeated mongod crash-loop patterns across replica set members within a short interval

Monitoring Recommendations

Enable verbose TLS logging on MongoDB nodes to capture OCSP validation failures
Forward MongoDB process supervision events and crash telemetry to a centralized SIEM for correlation
Track outbound TLS destinations from database hosts and baseline expected peers
Monitor availability metrics for replica set members and shard nodes to catch DoS conditions early

How to Mitigate CVE-2026-13070

Immediate Actions Required

Apply the fixed MongoDB server release referenced in MongoDB JIRA Issue SERVER-128362 as soon as it is available for your deployment channel
Restrict outbound TLS connections from MongoDB hosts to known, trusted peers using network segmentation and egress firewall rules
Audit the cluster's trusted certificate authority and revoke or restrict any certificates that should not be presenting OCSP responses to the server
Ensure replica set members and shards communicate only over trusted network paths

Patch Information

Refer to the MongoDB JIRA Issue SERVER-128362 for fixed version details and vendor guidance. Apply the patched build across all replica set members and mongos routers. Restart processes in a rolling fashion to maintain availability during remediation.

Workarounds

Route MongoDB inter-node and outbound TLS traffic exclusively over trusted, segmented networks to eliminate untrusted-path exposure
Tighten the set of certificate authorities configured as trusted for the cluster to reduce the pool of peers able to trigger the code path
Where operationally acceptable and supported by the deployment, disable OCSP stapling validation for outgoing TLS connections until the patch is applied
Deploy process supervision that rate-limits automatic restarts to prevent crash-loop amplification while investigating events

bash

# Example: restrict egress TLS from MongoDB hosts to known cluster peers
# Replace 10.0.0.0/24 with your cluster subnet
iptables -A OUTPUT -p tcp --dport 27017 -d 10.0.0.0/24 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 27017 -j DROP