A MongoDB Server that initiates outbound TLS connections may terminate unexpectedly when it receives a malformed OCSP response during the handshake. The server's default OCSP stapling validation, enabled for all outbound connections, has a flaw that allows a crafted response to trigger an abnormal shutdown. This results in a denial of service at the process level and could disrupt database availability. The weakness is categorized as a Null Pointer Dereference (CWE-476).

MongoDB Server products that have outbound TLS capabilities with default OCSP stapling enabled. No specific version range is listed, so all versions that perform outbound TLS handshakes are potentially affected until patched. The flaw only manifests when the remote peer presents a certificate issued by the cluster’s trusted CA or the connection traverses an untrusted path. Operating systems, clusters, or deployment environments are not distinguished.

The CVSS score of 6 indicates moderate severity and the EPSS score is <1%, so known exploitation probability cannot be quantified. The flaw can be exploited remotely by an attacker controlling a peer that the MongoDB server connects to, or by manipulating traffic over an untrusted network segment. It does not allow direct code execution or credential compromise; the impact is limited to process termination, possibly harming availability. The flaw is not listed in CISA KEV, suggesting no publicly observed exploitation yet, but monitoring is advised.