Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-13076 EUVD-2026-47785GHSA-qc6v-35w2-x3gc

Aggregation Framework Memory Exhaustion Leading to Process Termination

Published Jul 22, 2026 · Updated Jul 23, 2026 · Assigned by mongodb

Description

An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries.

Affected products

VendorProductAffectedFixed
MongoDB MongoDB Server 8.3.0 – < 8.3.7 8.3.7

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS mongodb No fix yet —
Ubuntu Pro 18.04 LTS mongodb No fix yet —
Ubuntu Pro 16.04 LTS mongodb No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS mongodb No fix yet —

Advisories 1

References