MongoDB 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128316)

The version of MongoDB installed on the remote host is 8.2.x prior to 8.2.12 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and...

Linux Distros Unpatched Vulnerability : CVE-2026-13077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of- bounds heap read via a crafted aggregation pipeline. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-13075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregati...

Linux Distros Unpatched Vulnerability : CVE-2026-13063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-13076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion...

Linux Distros Unpatched Vulnerability : CVE-2026-13073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in deni...

CVE-2026-64458 mm/damon/ops-common: handle extreme intervals in damon_hot_score()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

EUVD-2026-48802

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

PT-2026-64679

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Three issues exist in the damon hot score function due to improper handling of extreme monitoring intervals configured by the user. If the sampling interval is set to zero, the damon max...

GHSA-7PPR-R889-MCF2 blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in AbstractPolicyOperator during policy normalization. An attacker can force excessive resource consumption by supplying crafted policies that use ExactlyOne aggregation to evade the...

CVE-2026-13078

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

CVE-2026-13076

An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...

CVE-2026-13077

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

CVE-2026-13072

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default...

CVE-2026-13073

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...

CVE-2026-13071

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

CVE-2026-13065

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

CVE-2026-13063

An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively larg...