Is CVE-2026-13065 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-13065?

CVE-2026-13065 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-13065

Description

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.