A flaw in the Windows Enterprise implementation of the MongoDB server-side SSPI Kerberos authentication handler causes the server to fail to release underlying system resources when processing specific authentication requests. The error leads to a resource leak that can be exploited by an unauthenticated user. Repeatedly sending Kerberos authentication requests depletes the available server resources, eventually causing all subsequent Kerberos authentication attempts to fail. The consequence is a denial of service that affects the availability of the MongoDB service.

The vulnerability affects MongoDB Server running on Windows Enterprise builds. No particular version numbers are provided, so all builds on Windows Enterprise that implement the SSPI Kerberos handler are potentially impacted.

The CVSS score of 8.2 indicates a high severity of resource exhaustion. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the effect unauthenticated by repeatedly sending Kerberos authentication requests to the MongoDB server, exhausting internal resources and causing subsequent authentication attempts to fail. Once resources are exhausted, the server must be restarted to recover.