MongoDB Server’s query planner fails to validate input correctly, allowing an authenticated user with read-level access to submit a specially formed query against a collection that has a text index. The malformed query causes the server process to terminate unexpectedly, leading to a denial of service that interrupts all connected clients and any in‑flight operations. The vulnerability is a classic instance of NULL pointer dereference, identified as CWE-476.

MongoDB Server is the affected product. Any instance of the server running the affected code is vulnerable; the data does not specify exact version ranges, so all current releases before a vendor fix are potentially impacted.

The CVSS score of 6.0 indicates moderate impact. The EPSS score of less than 1% suggests a low probability of exploitation at present. Because the vulnerability requires an authenticated user with read permissions and a text‑indexed collection, the attack surface is somewhat limited and it is not listed in the CISA KEV catalog. The exploit path involves submitting a crafted query through any legitimate client connection.