An unauthenticated remote client can trigger a denial of service by sending a specially crafted awaitable hello command in exhaust mode. The server’s processing of this command causes a response loop that bypasses ordinary throttling, leading to excessive CPU consumption and degraded availability for all connections. The weakness is a classic resource exhaustion flaw, categorized as CWE‑770.

MongoDB Server is affected. No specific version information was supplied in the CVE data, so any deployment of the MongoDB Server product should be treated as potentially vulnerable until further detail is available.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score of < 1% (approximately 0.26%) indicates a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote and does not require authentication; therefore, an attacker can initiate the exploit over the network from any location with network access to the MongoDB Server. The impact is limited to availability, but the lack of authentication and possible unrestricted access make the vulnerability potentially exploitable against production systems.