CVE-2026-13074: MongoDB Server DoS Vulnerability

CVE-2026-13074 Overview

CVE-2026-13074 is a resource exhaustion vulnerability in MongoDB that allows unauthenticated remote attackers to cause excessive CPU consumption. The flaw stems from how the server handles a specific combination of parameters passed to the awaitable hello command when operating in exhaust mode. The server enters a response loop that bypasses normal throttling controls, letting a small number of connections degrade availability. The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling and is documented in MongoDB Jira Issue SERVER-128517.

Critical Impact
Unauthenticated network attackers can degrade MongoDB server availability using only a few crafted connections, without requiring credentials or user interaction.

Affected Products

MongoDB Server (versions referenced in SERVER-128517)
Deployments exposing the MongoDB wire protocol to untrusted networks
MongoDB clusters accepting unauthenticated hello command traffic

Discovery Timeline

2026-07-22 - CVE CVE-2026-13074 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-13074

Vulnerability Analysis

The MongoDB hello command is used by drivers and clients to negotiate connection parameters and topology information. In its awaitable form, the server holds the response open until a state change or timeout occurs, enabling efficient topology monitoring. Exhaust mode allows the server to stream multiple responses on a single connection without requiring the client to issue additional requests.

When an attacker combines specific parameters on the awaitable hello command while requesting exhaust mode, the server enters a tight response loop. Normal throttling mechanisms that would rate-limit or pause the response cycle do not apply to this parameter combination. Each active connection consumes CPU cycles continuously, so even a handful of connections can saturate server threads and degrade availability for legitimate clients.

Root Cause

The root cause is missing throttling on a code path that combines awaitable and exhaust semantics with specific parameter values. Under CWE-770, the server allocates CPU work to the response loop without enforcing an upper bound or backoff. The awaitable timing controls that normally gate response frequency are bypassed by the parameter combination.

Attack Vector

The attack requires network reachability to the MongoDB wire protocol port, typically 27017. No authentication or user interaction is required. An attacker opens one or more TCP connections, sends the crafted awaitable hello command in exhaust mode, and holds the connection open. The server sustains high CPU usage per connection until the socket closes.

The vulnerability affects availability only. Confidentiality and integrity are not impacted. Refer to MongoDB Jira Issue SERVER-128517 for the parameter-level technical details.

Detection Methods for CVE-2026-13074

Indicators of Compromise

Sustained high CPU utilization on mongod processes without a corresponding increase in query volume or working set size.
Long-lived connections from unexpected source addresses issuing hello or isMaster commands with exhaustAllowed set.
Elevated connections.active counters in serverStatus output while query throughput remains flat or drops.
Client-side timeouts and driver reconnection storms against an otherwise healthy cluster.

Detection Strategies

Parse MongoDB slow query and command logs for hello commands with exhaustAllowed: true combined with awaitable parameters from untrusted sources.
Correlate per-connection CPU time with command mix, flagging connections whose CPU consumption is disproportionate to executed operations.
Baseline the normal distribution of hello command frequency per client and alert on outliers.

Monitoring Recommendations

Track db.serverStatus().network and db.serverStatus().connections metrics for anomalies in connection duration and byte counts.
Enable network flow logging on MongoDB listener ports and forward it to a centralized analytics platform.
Alert on process-level CPU saturation on database hosts, especially when originating from a small number of client IPs.

How to Mitigate CVE-2026-13074

Immediate Actions Required

Upgrade MongoDB Server to a version that includes the fix referenced in SERVER-128517 as soon as it is available for your release train.
Restrict network access to MongoDB ports so that only trusted application tiers and administrative hosts can reach the wire protocol.
Enable authentication and disable unauthenticated access on all replica set members and mongos routers.
Terminate suspicious long-lived connections and rate-limit new connections from unknown sources at the network edge.

Patch Information

MongoDB tracks the fix in Jira issue SERVER-128517. Apply the patched release for your supported major version once published, and validate the upgrade in a staging environment before rolling to production replica sets.

Workarounds

Place MongoDB behind a firewall or private network segment that blocks direct client access from the internet.
Configure connection limits per source IP using a network proxy or host-based firewall to reduce blast radius.
Set aggressive maxIncomingConnections values in mongod.conf to cap the number of simultaneous connections a single host can maintain.

bash

# Configuration example: restrict MongoDB exposure and cap connections
# /etc/mongod.conf
net:
  bindIp: 127.0.0.1,10.0.0.10
  port: 27017
  maxIncomingConnections: 200

security:
  authorization: enabled

# Host-based firewall: allow only application tier
iptables -A INPUT -p tcp --dport 27017 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 27017 -j DROP