Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
MongoDB patched 26 vulns including critical memory corruption flaw CVE-2026-13072 https://ift.tt/JMHjq3w
Post summary
MongoDB has released patches for 26 vulnerabilities, including the critical memory corruption flaw CVE-2026-13072, highlighting a vendor remediation effort.
🚨Critical - MongoDB Server Memory Corruption via Aggregation in Compute Mode (CVE-2026-13072) When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can corrupt memory, potentially causing process termination or other unintended behavior. Compute mode is non-default and must be explicitly enabled at startup, so standard MongoDB deployments are not affected. Where it is enabled, crafted BSON in an aggregation pipeline can crash or destabilize the database process. CVSS 9.2. 👉Upgrade MongoDB Server to 7.0.39, 8.0.28, 8.2.12, or 8.3.7 depending on your branch.
Post summary
The text announces a critical vulnerability (CVE‑2026‑13072) affecting MongoDB when compute mode is enabled, highlights memory corruption risks, and provides specific upgrade steps to mitigate the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mongodb | mongodb | - | - | - |