Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

MongoDB server can crash from malformed transaction command

CVE-2026-13058 · published 3 months ago
Summary

MongoDB servers can be stopped unexpectedly if a user with basic write rights sends a specially crafted transaction request that is missing required information. This causes the database process to shut down, leading to a temporary loss of service. To protect your systems, apply the latest MongoDB updates and limit write permissions to only those who need them.

What to do
  • Update mongodb mongodb server to version 8.0.28 or later.
Affected software
Ecosystem VendorProductAffected versions
– mongodb mongodb server < 8.0.28
– mongodb mongodb >= 8.0.0, < 8.0.28
>= 8.2.0, < 8.2.12
>= 8.3.0, < 8.3.7
cpe:2.3:a:mongodb:mongodb:*:*:*:*:-:*:*:*
Ubuntu:Pro:14.04:LTS canonical mongodb All versions
Ubuntu:Pro:16.04:LTS canonical mongodb All versions
Ubuntu:Pro:18.04:LTS canonical mongodb All versions
Ubuntu:Pro:20.04:LTS canonical mongodb All versions
Original advisory text
Transaction Command Insufficient Input Validation Leading to Process Termination
An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-617Reachable Assertion
Timeline
Published22 Jul 2026
Updated4 Nov 2026
First seen23 Jul 2026
Sources
CVE-2026-13058 · NVD
CVE-2026-13058 · MITRE
UBUNTU-CVE-2026-13058 · OSV
CVE-2026-13058 · OSV
Track software like this
Free during beta