CVE-2026-13066— Server-Side JavaScript DBPointer BSON序列化内存泄露漏洞
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 4
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| MongoDB | MongoDB Server | 7.0< 7.0.39 | affected |
8.0< 8.0.28 | affected | ||
8.2.0< 8.2.12 | affected | ||
8.3.0< 8.3.7 | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-13066の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
ソース: CVE Program / CVE List V5
脆弱性説明
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
使用不兼容类型访问资源(类型混淆)
ソース: CVE Program / CVE List V5
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| MongoDB | MongoDB Server | 7.0 ~ 7.0.39 | - |
II. CVE-2026-13066の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-13066のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · MongoDB · 2026-07-22 · 26 CVEs total
| CVE-2026-13059 | 8.1 HIGH | Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Contr |
| CVE-2026-13072 | 8.1 HIGH | MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memo |
| CVE-2026-14881 | 7.8 HIGH | Compass connection import allows to override OIDC browser open command (usually set throug |
| CVE-2026-13078 | 7.7 HIGH | Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader |
| CVE-2026-13077 | 7.1 HIGH | Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data |
| CVE-2026-13058 | 7.1 HIGH | Transaction Command Insufficient Input Validation Leading to Process Termination |
| CVE-2026-13056 | 6.5 MEDIUM | A user with read access can cause a DoS by executing a specifically crafted query to consu |
| CVE-2026-13062 | 6.5 MEDIUM | MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Command |
| CVE-2026-13060 | 6.5 MEDIUM | $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Col |
| CVE-2026-13075 | 6.5 MEDIUM | $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generatio |
| CVE-2026-13065 | 6.5 MEDIUM | MongoDB $linearFill Window Function Improper Input Validation Leading to Process Terminati |
| CVE-2026-13055 | 6.5 MEDIUM | Server crash via aggregation pipeline expression with compound wildcard index specificatio |
| CVE-2026-13069 | 6.5 MEDIUM | Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaus |
| CVE-2026-9737 | 6.5 MEDIUM | Find command with $meta sort can lead to crash |
| CVE-2026-13064 | 6.5 MEDIUM | MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service |
| CVE-2026-13076 | 6.5 MEDIUM | Aggregation Framework Memory Exhaustion Leading to Process Termination |
| CVE-2026-13071 | 6.5 MEDIUM | Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termi |
| CVE-2026-13067 | 6.3 MEDIUM | tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket |
| CVE-2026-13057 | 5.3 MEDIUM | Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collec |
| CVE-2026-13070 | 5.3 MEDIUM | Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Term |
Showing 20 of 26 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: MongoDB Server
- CVE-2026-13055
Server crash via aggregation pipeline expression with compou - CVE-2026-13056
A user with read access can cause a DoS by executing a speci - CVE-2026-13057
Authorization Bypass via Client-Supplied $search.mergingPipe - CVE-2026-13058
Transaction Command Insufficient Input Validation Leading to - CVE-2026-13059
Improper Validation of Client-Supplied Command Parameters Al
同じベンダー: MongoDB
- CVE-2026-14881
Compass connection import allows to override OIDC browser op - CVE-2026-13055
Server crash via aggregation pipeline expression with compou - CVE-2026-13056
A user with read access can cause a DoS by executing a speci - CVE-2026-13057
Authorization Bypass via Client-Supplied $search.mergingPipe - CVE-2026-13058
Transaction Command Insufficient Input Validation Leading to
V. CVE-2026-13066へのコメント
まだコメントはありません