MongoDB Server was found to improperly validate certain request parameters during a queryable encryption maintenance operation. An authenticated user with readWrite privileges could craft a request that triggers a server crash or a large amount of internal writes, exhausting resources and corrupting encrypted index data. The vulnerability stems from an integer overflow or wraparound condition as classified by CWE‑191. The primary impact is a denial of service and data integrity loss for the affected database instance.

MongoDB Server is affected specifically in deployments that enable queryable encryption and perform maintenance operations on encrypted collections. The advisory does not specify a version range, so all MongoDB Server instances that accept the relevant maintenance request are potentially impacted until a patch is applied.

The CVSS score of 7.1 indicates moderate to high severity. EPSS is less than 1 %, suggesting a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with readWrite privileges; an attacker would need to compromise credentials or otherwise gain write access to the database. Once access is attained, a specially crafted maintenance command can cause a crash or resource exhaustion, affecting availability for legitimate users.