What is GHSA-c3m4-h7px-8423?

GHSA-c3m4-h7px-8423 is a security advisory published by GitHub Security Advisories with High severity. The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a...

Which CVE IDs does GHSA-c3m4-h7px-8423 cover?

GHSA-c3m4-h7px-8423 covers the following CVE IDs: CVE-2026-13055. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c3m4-h7px-8423?

GHSA-c3m4-h7px-8423 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-c3m4-h7px-8423HighCVSS 6.5

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a...

Vendor

GitHub Security Advisories

Published

July 22, 2026

Last Modified

July 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-13055 →

📋 Description

The $_internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13055
https://jira.mongodb.org/browse/SERVER-123081
https://github.com/advisories/GHSA-c3m4-h7px-8423