MongoDB Server’s collection validation feature can mishandle certain expressions stored in a validator, causing the server process to abort when a document is inserted. The flaw is a null pointer dereference (CWE‑476) and leads to an unresponsive server rather than code execution. Compromised or misconfigured collections can be leveraged to disrupt availability but do not grant direct attacker access to data or control.

Vendors affected: MongoDB. Product: MongoDB Server. No specific version range is listed in the advisory, so all current releases of MongoDB Server are potentially impacted until a vendor fix is released.

The CVSS score of 7.1 reflects a moderate‑to‑high severity with a medium exploitation difficulty and requires the attacker to be an authenticated user with write privileges on the target database. The EPSS score is unavailable, and the vulnerability is not catalogued in CISA’s KEV list, implying limited public exploit evidence. However, any authenticated user with write access could trigger a denial‑of‑service condition, and repeated crashes might be exploitable in a high‑availability setup if fail‑over is not correctly configured.