An authenticated user can force the mongod process to terminate under memory pressure by issuing aggregation queries that use the $rankFusion and $scoreFusion stages. The flaw originates in the server's error‑handling path and results in an unbounded memory allocation that causes an out‑of‑memory condition and an orderly shutdown of the mongod service. This leads to a temporary or permanent denial of service for the affected database instance.

MongoDB Server is the affected product. No specific product versions are listed, so the vulnerability applies to any deployed MongoDB Server instance that supports the $rankFusion and $scoreFusion aggregation stages.

The CVSS score of 7.1 indicates medium to high severity. Exploitation requires that the attacker be authenticated and possess the ability to run aggregation queries, limiting the threat to users with sufficient privileges. The EPSS score of <1% and the absence of a KEV listing suggest that widespread exploitation has not yet been observed. However, an attacker who can meet the prerequisites can achieve a deliberate out‑of‑memory condition, causing the mongod process to terminate and disrupting service availability.