Skip to content
Percona Software for MongoDB Documentation

Rate this page
☆ ☆ ☆ ☆ ☆
Thanks for your feedback
Thank you! The feedback has been submitted.

Get free database assistance or contact our experts for personalized support.

Get help from Percona

Percona Server for MongoDB 7.0.39-21 (2026-08-05)

Installation Upgrade from MongoDB Community

Percona Server for MongoDB 7.0.39-21 is an enhanced, source-available, and highly-scalable database that is a fully-compatible, drop-in replacement for MongoDB Community Edition.

Percona Server for MongoDB 7.0.39-21 includes the improvements and bug fixes of:

Upgrade recommendation

This release contains multiple high-severity security fixes affecting all Percona Server for MongoDB 7.0.x versions. We strongly recommend upgrading to version 7.0.39-21 as soon as possible.

Release Highlights

Software Bill of Materials (SBOM)

Percona Server for MongoDB (PSMDB) now provides Software Bills of Materials (SBOMs) and Vulnerability Exploitability Exchange (VEX) for every release. SBOMs improve software supply chain transparency by documenting the components and dependencies included in a build. They are generated automatically as part of the release pipeline in the industry standard CycloneDX format.

SBOMs are distributed through the following channels:

  • Tarballs: An SBOM is included in doc/sbom.cdx.json file.

  • Packages: For .deb and .rpm packages, the SBOM file is installed in a standard documentation directory such as /usr/share/doc/percona-server-mongodb-server/sbom.cdx.json.

  • Docker: The SBOM is attached directly to the Docker image as metadata.

OpenVEX files are published on GitHub Pages and provide the exploitability status of known vulnerabilities.

  • Each release has a separate file that follows this format:
https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-7.0.39-21.vex.json

For comprehensive information, refer to our documentation.

Security fixes from upstream MongoDB

Critical severity

  • SERVER-128494 (CVE-2026-13072 ): Fixed an issue where compute mode on a standalone MongoDB instance could cause memory corruption while processing externally sourced BSON data in an aggregation pipeline. This could cause the process to terminate or behave unexpectedly. Compute mode is disabled by default and must be enabled explicitly at startup.

High severity

  • SERVER-123081 (CVE-2026-13055 ): Fixed an issue in the $_internalIndexKey aggregation expression. An authenticated user with permission to run aggregation pipelines could submit a compound wildcard index specification that caused mongod to stop, resulting in a denial-of-service attack.

  • SERVER-127280 (CVE-2026-13065 ): Fixed an input validation issue in $linearFill. A user with read-only access could provide an unsupported expression in sortBy, causing mongod to stop and resulting in a denial-of-service.

  • SERVER-127357 (CVE-2026-13060 ): Fixed an issue in the $graphLookup aggregation stage that could allow an authenticated user with limited read permissions to access documents from restricted collections. This could occur when the collections were referenced in an existing view pipeline.

  • SERVER-127566 (CVE-2026-13069 ): Added a limit for the contention value used with Queryable Encryption (FLE2). Previously, an authenticated user could submit a request with a very high value, consuming excessive CPU or memory and making the server slow or unresponsive.

  • SERVER-127694 (CVE-2026-13066 ): Resolved an issue where improper handling of DBPointer objects during BSON serialization in the server-side JavaScript engine could expose internal memory contents to the client. This information disclosure vulnerability affected deployments that use server-side JavaScript.

  • SERVER-127831 (CVE-2026-13062 ): Resolved an issue where an authenticated user with write privileges on a collection that supports Queryable Encryption could modify internal encryption metadata fields, which are intended to be controlled by the server. This was achieved by sending crafted write commands through the mongos router in a sharded cluster. As a result, this could lead to incorrectly encrypted queries.

  • SERVER-128341 (CVE-2026-9737 ): Corrected an issue in query planning where reading the sort pattern in raw BSONObj form did not explicitly handle the meta-expression case. This omission could lead to incorrect transformations and potentially cause invariant failures.

  • SERVER-128433 (CVE-2026-13059 ): Resolved an issue where an authenticated user with limited privileges could bypass role-based query-level access controls by submitting specially crafted command parameters. This could allow unauthorized read or write operations through the find, update, delete, and aggregate commands when strict API rules were not enforced.

  • SERVER-128473 (CVE-2026-13071 ): Resolved an issue where an authenticated user with read access could terminate the mongod process using certain aggregation expressions that execute server-side JavaScript. This issue was caused by improper memory handling during document processing.

  • SERVER-129103 (CVE-2026-13077 ): Fixed an issue where MongoDB did not properly validate CodeWScope elements in malformed BSONColumn data. An authenticated user could exploit this with a crafted aggregation pipeline, causing mongod to stop or expose nearby process memory.

Medium severity

  • SERVER-127689 (CVE-2026-13061 ): Fixed an issue in the $listSessions aggregation stage that could expose session information to users without the required cluster-level privileges. An authenticated user could view other users’ session IDs, usernames, and activity timestamps.

  • SERVER-128362 (CVE-2026-13070 ): Resolved an issue where a MongoDB server could terminate unexpectedly while processing a malformed OCSP response during an outbound TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Exploitation required either a remote peer with a certificate issued by the cluster’s trusted certificate authority or a connection passing through an untrusted network path.

  • SERVER-128517 (CVE-2026-13074 ): Fixed an issue where pre-authentication hello requests in exhaust mode accepted very small maxAwaitTimeMS values. An unauthenticated client could use this behavior to create a tight response loop that consumed excessive CPU and reduced server availability.

  • SERVER-128832 (CVE-2026-13078 ): Fixed an issue discovered in MongoDB Server, where the server-side MozJS scripting engine unconditionally registered a module-loading hook that enables JavaScript to read arbitrary files from the host filesystem using the mongod process’s privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process.

For the complete upstream changelog, see MongoDB 7.0.39 Community Edition .

Changelog

New features

  • PSMDB-2150: Percona Server for MongoDB (PSMDB) now provides Software Bills of Materials (SBOMs) for every release.

Bugs fixed

  • PSMDB-2212: Fixed an issue where mongod could terminate unexpectedly with a SIGABRT signal when using native LDAP authentication if an LDAP operation timed out. mongod now handles LDAP timeout conditions correctly, preventing unexpected process termination.

Tools packaged with this release

Tool Base version Release notes
MongoDB Shell (mongosh) 2.9.2 upstream release notes
Mongo Tools 100.17.0 upstream release notes