The vulnerability allows MongoDB Server to run out of memory while evaluating expressions that generate deeply nested documents. Recursive functions in the server fail to monitor expression depth, leading to an out‑of‑memory condition that can cause the mongod process to crash. The impact is a denial‑of‑service to the database instance, affecting data availability but not compromising confidentiality or integrity directly.

All releases of MongoDB Server from the vendor MongoDB Inc are affected. No version ranges are specified, so all deployed versions should be considered vulnerable until a patch is applied. Administrators should treat all installations of MongoDB Server as impacted.

The vulnerability carries a CVSS score of 7.1, indicating a high severity. The EPSS probability is reported as less than 1%, meaning exploitation is considered unlikely but possible. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Likely attack vectors include remote clients submitting queries that construct deeply nested expressions; the path is inferred from the description of recursive expression evaluation. Successful exploitation would require the attacker to trigger the server’s expression parser with a crafted input, leading to a server crash.