CVE-2026-13066
No fix known EPSS <1%CVSS 6.5
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.
Products: mongodb_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 14.04 LTS | mongodb | no fix |
| Ubuntu Pro 16.04 LTS | mongodb | no fix |
| Ubuntu Pro 18.04 LTS | mongodb | no fix |
| Ubuntu Pro 20.04 LTS | mongodb | no fix |