CVE-2026-13070— Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

CVSS 5.3 · Medium EPSS 0.13% · P3 Updated Jul 23, 2026

Possible ATT&CK Techniques 1AI

Affected Version Matrix 4

Vendor	Product	Version Range	Status
MongoDB	MongoDB Server	`7.0< 7.0.39`	affected
		`8.0< 8.0.28`	affected
		`8.2.0< 8.2.12`	affected
		`8.3.0< 8.3.7`	affected

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-13070

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

Source: CVE Program / CVE List V5

Vulnerability Description

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a certificate issued by the cluster's trusted certificate authority, or for the connection to traverse an untrusted network path.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

空指针解引用

Source: CVE Program / CVE List V5

Vulnerability Title

MongoDB Server 异常处理不当漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

MongoDB Server是美国MongoDB公司开源的一套开源的NoSQL数据库。该数据库提供面向集合的存储、动态查询、数据复制及自动故障转移等功能。 MongoDB Server 7.0.39之前版本、8.0.28之前版本、8.2.12之前版本和8.3.7之前版本存在异常处理不当漏洞，该漏洞源于在处理远程对等节点发送的异常OCSP响应时，导致异常终止。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
MongoDB	MongoDB Server	7.0 ~ 7.0.39	-

II. Public POCs for CVE-2026-13070

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2026-13070

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-13070 (1)

🔗 [SERVER-128362] Add null-check on return value in ocspClientCallback - MongoDB Jira Read full article

https://www.cve.org/CVERecord?id=CVE-2026-13070

Same Patch Batch · MongoDB · 2026-07-22 · 26 CVEs total

CVE-2026-13059	8.1 HIGH	Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Contr
CVE-2026-13072	8.1 HIGH	MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memo
CVE-2026-14881	7.8 HIGH	Compass connection import allows to override OIDC browser open command (usually set throug
CVE-2026-13078	7.7 HIGH	Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
CVE-2026-13077	7.1 HIGH	Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data
CVE-2026-13058	7.1 HIGH	Transaction Command Insufficient Input Validation Leading to Process Termination
CVE-2026-13056	6.5 MEDIUM	A user with read access can cause a DoS by executing a specifically crafted query to consu
CVE-2026-13062	6.5 MEDIUM	MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Command
CVE-2026-13060	6.5 MEDIUM	$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Col
CVE-2026-13066	6.5 MEDIUM	Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure
CVE-2026-13075	6.5 MEDIUM	$rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generatio
CVE-2026-13065	6.5 MEDIUM	MongoDB $linearFill Window Function Improper Input Validation Leading to Process Terminati
CVE-2026-13055	6.5 MEDIUM	Server crash via aggregation pipeline expression with compound wildcard index specificatio
CVE-2026-13069	6.5 MEDIUM	Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaus
CVE-2026-9737	6.5 MEDIUM	Find command with $meta sort can lead to crash
CVE-2026-13064	6.5 MEDIUM	MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service
CVE-2026-13076	6.5 MEDIUM	Aggregation Framework Memory Exhaustion Leading to Process Termination
CVE-2026-13071	6.5 MEDIUM	Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termi
CVE-2026-13067	6.3 MEDIUM	tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
CVE-2026-13057	5.3 MEDIUM	Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collec

Showing top 20 of 26 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: MongoDB Server

Same vendor: MongoDB

Same weakness: CWE-476

V. Comments for CVE-2026-13070

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-13070— Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination

Possible ATT&CK Techniques 1AI

Affected Version Matrix 4

I. Basic Information for CVE-2026-13070

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-13070

III. Intelligence Information for CVE-2026-13070

Patches & Fixes for CVE-2026-13070 (1)

Same Patch Batch · MongoDB · 2026-07-22 · 26 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-13070

Leave a comment