CVE-2026-13063: An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. Mong

mediumCVSS 4.3CVE-2026-13063

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 4.3
Published: 2026-07-22
Last updated: 2026-07-23
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-13063

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-130630.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-13063	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownMongoDB Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in MongoDB (July 24, 2026)cert-fr-avis
high[NEW] [high] MongoDB: Multiple vulnerabilitiescert-bund

Recent advisories for An authenticated user

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…nvd · 2026-08-01
highCVE-2026-67343: ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/s…nvd · 2026-08-01
highCVE-2026-67331: better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM pr…nvd · 2026-08-01
highCVE-2026-67328: @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities…nvd · 2026-08-01
unknownCVE-2026-11882: The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public O…nvd · 2026-08-01
highCVE-2026-65981: Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server…nvd · 2026-07-31