Vulnerability · Published Jul 22, 2026 · Assigned by mongodb
CVE-2026-13074Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service
Medium 5.3
In plain English
A medium-severity resource allocation without limits in MongoDB Server from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | MongoDB Server | 7.0 – before 7.0.398.0 – before 8.0.288.2.0 – before 8.2.128.3.0 – before 8.3.7 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L