Connections received that come through the proxy port are not tracked toward the server’s total accepted connection count, which can cause MongoDB Server to exceed its resource limits and crash. The flaw is a Resource Exhaustion issue, classified as CWE-770, where an attacker can force the server to consume more memory or file handles than it is configured to handle.

MongoDB Inc’s MongoDB Server is affected. The vulnerability applies to any installation that accepts connections via the proxy port and processes the proxy protocol header. Exact software versions are not listed, so all currently supported MongoDB Server releases that enable proxy handling may be impacted.

The vulnerability carries a CVSS score of 8.2, indicating high severity, but the EPSS score is under 1%, suggesting that known exploit activity is currently very low. It is not listed in the CISA KEV catalog. The likely attack vector involves an attacker opening a large number of connections through the proxy port, using the proxy protocol header to mask traffic, thereby causing the server to ignore these connections in its accounting and eventually exhaust available resources, leading to a crash. Because the vulnerability requires only proxy connections, it does not need privileged credentials and can be executed remotely from outside the server over the network.