An authenticated user can send a specially crafted Queryable Encryption find payload that contains an unvalidated field controlling an internal computation loop. This leads to excessive CPU usage or out‑of‑memory conditions on the MongoDB server, resulting in resource exhaustion that degrades availability for other operations.

MongoDB Server. No specific version information is available; all current releases may be impacted until a fix is released.

The CVSS score of 7.1 classifies the vulnerability as high severity, indicating a significant impact if exploited. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, implying no evidence of widespread exploitation. Attack requires authentication and knowledge of the Queryable Encryption find operation; the lack of input validation allows an attacker to trigger an uncontrolled loop, consuming CPU or memory and causing a denial of service. With legitimate credentials, the exploit path is straightforward, making this a notable risk for systems with insufficient access controls on the Queryable Encryption feature.