Windows apps · Application version · June 11, 2026
MongoDB 8.3.7
MongoDB 8.3.7, released June 11, 2026, fixes 24 CVEs in MongoDB. None of them is reported as exploited. Patch Radar priority: Urgent. The latest MongoDB is 9.0.4, which also fixes every one of these CVEs.
Urgent
Superseded. The latest MongoDB is 9.0.4, which also fixes every CVE on this page. Install that instead.
CVEs closed
24
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.2
Base score, 0 to 10
Highest EPSS
0.0050
42nd percentile
Priority of the 24 CVEs
Patch now 0
Urgent 1
High 16
Routine 7
Applies to
| Product | Version |
|---|---|
| MongoDB | 8.3.7 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-13072 | MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption | 9.2 | 0.0040 | None reported |
| High | CVE-2026-13065 | MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination | 7.1 | 0.0050 | None reported |
| High | CVE-2026-13064 | MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service | 7.1 | 0.0045 | None reported |
| High | CVE-2026-13060 | $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access | 7.1 | 0.0043 | None reported |
| High | CVE-2026-13077 | Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data | 7.1 | 0.0042 | None reported |
| High | CVE-2026-13071 | Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination | 7.1 | 0.0042 | None reported |
| High | CVE-2026-13075 | $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation | 7.1 | 0.0042 | None reported |
| High | CVE-2026-13076 | Aggregation Framework Memory Exhaustion Leading to Process Termination | 7.1 | 0.0042 | None reported |
| High | CVE-2026-9737 | Find command with $meta sort can lead to crash | 7.1 | 0.0042 | None reported |
| High | CVE-2026-13055 | Server crash via aggregation pipeline expression with compound wildcard index specification | 7.1 | 0.0040 | None reported |
| High | CVE-2026-13056 | A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM | 7.1 | 0.0040 | None reported |
| High | CVE-2026-13058 | Transaction Command Insufficient Input Validation Leading to Process Termination | 7.1 | 0.0040 | None reported |
| High | CVE-2026-13059 | Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass | 8.6 | 0.0038 | None reported |
| High | CVE-2026-13066 | Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure | 7.1 | 0.0037 | None reported |
| High | CVE-2026-13069 | Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion | 7.1 | 0.0029 | None reported |
| High | CVE-2026-13062 | MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters | 7.1 | 0.0019 | None reported |
| High | CVE-2026-13067 | tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket | 7.2 | 0.0010 | None reported |
| Routine | CVE-2026-13074 | Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service | 6.9 | 0.0044 | None reported |
| Routine | CVE-2026-13063 | libmongocrypt Improper Input Validation Leading to Process Termination | 5.3 | 0.0040 | None reported |
| Routine | CVE-2026-13078 | Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader | 6.3 | 0.0038 | None reported |
| Routine | CVE-2026-13057 | Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META | 6.0 | 0.0035 | None reported |
| Routine | CVE-2026-13061 | Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage | 5.3 | 0.0028 | None reported |
| Routine | CVE-2026-13068 | MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse | 2.3 | 0.0025 | None reported |
| Routine | CVE-2026-13070 | Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination | 6.0 | 0.0013 | None reported |
Showing 1 to 24 of 24
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.