CVE-2026-13070

MediumCVSS 5.3/10Last modified Oct 24, 2026

Description

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
MongoDB	MongoDB Server	>= 7.0, < 7.0.39; >= 8.0, < 8.0.28; >= 8.2.0, < 8.2.12; >= 8.3.0, < 8.3.7

References

https://jira.mongodb.org/browse/SERVER-128362Issue Tracking, Patch

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-130716.5An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute se CVE-2026-130728.1When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pip CVE-2026-130734.3An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation comman CVE-2026-130745.3An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to CVE-2026-130756.5An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $s CVE-2026-130766.5An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific CVE-2026-130777.1A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggre CVE-2026-130787.7A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading ho CVE-2026-130797.8A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate thei CVE-2026-130806.6The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion i CVE-2026-130825.3GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CA CVE-2026-130836.9A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitizati