Vulnerability · Published Jul 22, 2026 · Assigned by mongodb
CVE-2026-13070Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination
Medium 5.3
In plain English
A medium-severity null pointer dereference in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 7.0 – before 7.0.398.0 – before 8.0.288.2.0 – before 8.2.128.3.0 – before 8.3.7 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H