AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MongoDBCVE-2026-13071

MongoDB Server: use after free

MongoDB

CVE-2026-13071 · Published Jul 22, 2026 · updated Aug 18, 2026

High7.1
Fix: upgrade to 7.0.39 or later (4 fixed versions below)
MongoDB advisory

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

Affected versions

PackageAffectedFixed in
MongoDB Server
Product
>= 7.0, < 7.0.397.0.39
>= 8.0, < 8.0.288.0.28
>= 8.2.0, < 8.2.128.2.12
>= 8.3.0, < 8.3.78.3.7
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-416

More MongoDB advisories

All MongoDB
High 7.1Jul 22MongoDB Server: reachable assertionCVE-2026-9737fixed in 7.0.39 +3High 8.4Jul 22MongoDB Compass: command injectionCVE-2026-14881fixed in 1.49.7Medium 6.9Jul 22MongoDB Server: resource exhaustionCVE-2026-13074fixed in 7.0.39 +3High 7.1Jul 22MongoDB Server: resource exhaustionCVE-2026-13075fixed in 8.2.12 +1High 7.1Jul 22MongoDB Server: resource exhaustionCVE-2026-13076fixed in 8.3.7High 7.1Jul 22MongoDB Server: out-of-bounds readCVE-2026-13077fixed in 7.0.39 +3