CVE-2026-13063: libmongocrypt Improper Input Validation Leading to Process Termination
An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13063?
The severity of CVE-2026-13063 is medium, with a score of 4.3.
How do I fix CVE-2026-13063?
To fix CVE-2026-13063, ensure that you are using the latest version of MongoDB libmongocrypt that addresses this vulnerability.
What impact does CVE-2026-13063 have on MongoDB users?
CVE-2026-13063 can cause the mongod process to terminate due to an out-of-memory condition when handling crafted aggregation commands.
Is CVE-2026-13063 exploitable by unauthenticated users?
No, CVE-2026-13063 requires an authenticated user with standard read/write privileges to exploit the vulnerability.
What type of vulnerability is CVE-2026-13063 classified as?
CVE-2026-13063 is classified as Improper Input Validation, specifically related to Integer Overflow.