Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-13074 EUVD-2026-47787GHSA-w3fp-8cx4-8vqp

Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

Published Jul 22, 2026 · Updated Jul 23, 2026 · Assigned by mongodb

Description

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 7.0 – < 7.0.39, 8.0 – < 8.0.28, 8.2.0 – < 8.2.12, 8.3.0 – < 8.3.7 7.0.39

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS mongodb No fix yet —
Ubuntu Pro 18.04 LTS mongodb No fix yet —
Ubuntu Pro 16.04 LTS mongodb No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS mongodb No fix yet —

Advisories 1

References