CVE-2026-13070 in MongoDB
Summary
by MITRE • 07/22/2026
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical denial of service condition in mongodb server implementations that can lead to unexpected termination during tls handshake operations. The flaw occurs when a mongodb instance attempts to establish an outbound tls connection and receives a malformed ocsp response from the remote peer during certificate validation. The issue stems from inadequate error handling within the ocsp stapling validation mechanism, which is enabled by default for all outgoing tls connections. When processing such malformed responses, the server fails to properly validate or sanitize the incoming data before attempting to parse it, resulting in an abnormal termination of the mongodb process.
The technical implementation flaw resides in how mongodb handles certificate validation during tls handshakes, specifically within the ocsp stapling component that is part of the standard tls security framework. This vulnerability falls under the category of improper input validation as defined by cwe-20 and represents a classic buffer overread or parsing error scenario. The attack vector requires specific conditions to be met including having a certificate issued by a trusted authority that the mongodb cluster recognizes, or traversing an untrusted network path where malicious actors can intercept and manipulate tls communications. This aligns with att&ck technique t1566 which involves the manipulation of network traffic to cause system failures.
The operational impact of this vulnerability is significant for mongodb deployments that rely on outbound tls connections to external services, databases, or api endpoints. When exploited, the abnormal termination can disrupt database operations and potentially lead to extended downtime for applications dependent on mongodb services. The default enablement of ocsp stapling means that any mongodb instance attempting outbound tls connections is vulnerable, regardless of whether administrators explicitly configured this feature. This makes the vulnerability particularly dangerous in production environments where mongodb instances are constantly establishing connections to external systems.
Mitigation strategies should focus on implementing proper input validation and error handling within the certificate validation process, as well as network-level protections against malicious ocsp responses. Organizations should consider disabling ocsp stapling for outbound connections if not strictly required, or implementing network monitoring to detect and prevent malformed ocsp responses from reaching mongodb instances. Additionally, maintaining up-to-date mongodb versions that include proper error handling for ocsp response parsing will provide defense-in-depth protection. The fix should address the core issue identified in cwe-20 through comprehensive validation of all incoming ocsp response data before processing, ensuring that malformed responses do not cause system termination.