TI-2026-11123 Aliases CVE-2026-13074 GHSA-w3fp-8cx4-8vqp

Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service

LOW 37CWE-770Published 2026-07-22 · Updated 2026-07-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00444 38th percentileScored 2026-11-07

Fix Fixed MongoDB Server (MongoDB): 7.0.39, 8.0.28, 8.2.12 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MongoDB	MongoDB Server	7.0 to before 7.0.39; 8.0 to before 8.0.28; 8.2.0 to before 8.2.12; 8.3.0 to before 8.3.7	7.0.39, 8.0.28, 8.2.12, 8.3.7	Patch available	CNA

MongoDB Server VendorMongoDB Affected 7.0 to before 7.0.39; 8.0 to before 8.0.28; 8.2.0 to before 8.2.12; 8.3.0 to before 8.3.7 Fixed in 7.0.39, 8.0.28, 8.2.12, 8.3.7 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mongodb:mongodb::::::::	7.0.0 to before 7.0.39; 8.0.0 to before 8.0.28; 8.2.0 to before 8.2.12; 8.3.0 to before 8.3.7	Vulnerable	MongoDB

cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.0.39; 8.0.0 to before 8.0.28; 8.2.0 to before 8.2.12; 8.3.0 to before 8.3.7 Vulnerable ·MongoDB

Remediation

Fix · CNA MongoDB Server (MongoDB) Fixed in 7.0.39, 8.0.28, 8.2.12, 8.3.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-07-22
MongoDB Server 7.0.39, 8.0.28 and 2 more versions
15 records Highest priority Priority MEDIUM 1 MEDIUM, 14 LOW
Other records, highest priority first
- TI-2026-11121 MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory CorruptionPriority MEDIUM 42
- TI-2026-11108 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control BypassPriority LOW 39
- TI-2026-11126 Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn DataPriority LOW 32
Show all 15 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-13074
2026-10-03 Alias added: GHSA-w3fp-8cx4-8vqp

References

Patch 1

https://jira.mongodb.org/browse/SERVER-128517

TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
TI-2013-01669 MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the… CVSS 2.0MEDIUM 6.0
TI-2026-56639 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service CVSS 4.0HIGH 8.7
TI-2026-56628 Reachable assertion in MongoDB Server CVSS 4.0HIGH 8.7
TI-2026-15322 Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos CVSS 4.0HIGH 8.7
TI-2026-08537 Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack overflow CVSS 4.0HIGH 8.7

See all 187 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences