Authenticated MongoDB users can execute the $_internalIndexKey aggregation expression with a compound wildcard index specification. Because the expression does not handle such specifications correctly, it triggers an internal consistency check that aborts the mongod process, causing a server crash. This denial of service affects database availability for all collections accessed by that instance.

MongoDB Server deployments that allow authenticated users to run aggregation pipelines are affected. No version information is disclosed, so any instance with the required aggregation capability may be vulnerable.

The CVSS score of 7.1 indicates a moderate to high severity. The attack requires authenticated access to issue aggregation commands, implying the attacker must have database credentials or an active session. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV, so no confirmed exploitation activity exists. Successful exploitation leads to an immediate crash of the mongod process, resulting in loss of availability for the affected database server.