Certain query operations that include deeply nested $jsonSchema constructs can trigger MongoDB to consume an excessive amount of CPU resources, leading to sustained high‑CPU usage that cannot be terminated by normal administrative controls. Because the process cannot be interrupted, the database service may become unresponsive for a prolonged period, effectively denying service to legitimate users. The flaw is an Excessive Resource Consumption defect identified as CWE‑407.

The affected product is MongoDB Server. No specific deployment versions are listed in the advisory, so any installation that accepts client queries containing complex $jsonSchema statements is potentially vulnerable. Organizations operating MongoDB Server should treat all current releases as at risk until a patched release is available.

The CVSS score of 7.1 indicates a moderate to high risk profile, while the EPSS score of <1% suggests a low probability of exploitation. Based on the description, it is inferred that the likely attack vector is through crafted queries sent over the network, which trigger the vulnerability. An attacker—authenticated or unauthenticated—can launch a denial‑of‑service attack by flooding the database with expensive $jsonSchema queries. The lack of a KEV listing indicates no widely observed exploitation at the time of this analysis.