CVE-2026-13065
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jul 22, 2026
Vendor
unknown
Description
A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.