CVE-2026-13074 in MongoDB
Summary
by MITRE • 07/22/2026
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical denial of service flaw in mongodb database systems that allows remote attackers to consume excessive cpu resources without authentication. The issue occurs specifically when an unauthenticated client sends a carefully crafted combination of parameters to the awaitable hello command while operating in exhaust mode. The technical implementation flaw stems from how mongodb processes this particular parameter combination during the initial handshake phase, creating a response loop that circumvents normal connection throttling mechanisms. This behavior fundamentally violates the expected resource management patterns defined in industry security standards such as cwe-400 which categorizes excessive resource consumption as a primary vulnerability class. The operational impact is significant as a small number of malicious connections can effectively degrade server availability and performance, potentially leading to complete service disruption. Attackers exploit this by establishing minimal connections and maintaining them in an infinite loop state, consuming cpu cycles continuously while bypassing normal connection limits that would typically prevent such resource exhaustion. The vulnerability demonstrates a failure in the mongodb server's input validation and response handling logic, particularly in how it manages the awaitable hello command sequence under specific mode conditions. This attack pattern aligns with tactics described in the attack framework where adversaries seek to consume system resources through legitimate but abusive protocol usage rather than direct exploitation of code execution vulnerabilities. The lack of authentication requirement makes this vector particularly dangerous as it can be exploited from any network location without prior access credentials. The response loop mechanism effectively starves the server of processing power by continuously generating responses that never terminate properly, creating a sustained cpu utilization spike that impacts all legitimate database operations. Organizations should implement immediate mitigations including connection rate limiting, firewall rules restricting mongodb access to trusted networks, and monitoring for unusual cpu patterns in database servers. The vulnerability also highlights the importance of proper input validation and defensive programming practices as outlined in secure coding guidelines, specifically addressing how servers should handle edge cases in protocol implementations. This flaw underscores the necessity for comprehensive testing of network protocols under various operational conditions including stress scenarios that might expose resource management weaknesses.