Complex queries can overwhelm the MongoDB Query Planner, causing excessive memory consumption and leading to an out‑of‑memory crash. The resulting failure shuts down the server, denying service to legitimate users. This vulnerability maps to the Exhaustive Resource Consumption weakness (CWE‑770).

The flaw affects MongoDB Server from MongoDB Inc. No specific version bounds are provided, so all releases may be vulnerable until a vendor statement clarifies the scope. Users should consult the referenced JIRA issue for detailed guidance.

The CVSS score of 7.1 indicates moderate to high severity, while the EPSS score of less than 1% reflects a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with query privileges; a crafted boolean expression can trigger the OOM crash, resulting in a denial of service. No publicly available exploits have been reported according to the current data.