The vulnerability is an improper input validation flaw in the aggregation command processing of MongoDB Server. A malformed aggregation request can cause the server process to terminate unexpectedly. Because the endpoint is authenticated, an attacker who can log in—potentially with no special privileges—can exploit this flaw. The impact is a denial of service that disrupts database availability, potentially affecting all applications that depend on the server. The weakness corresponds to CWE‑617. The exploit does not grant any additional privileges or access to data; it purely causes the service to crash.

MongoDB Server is the affected product. The flaw applies to any deployed instance that accepts aggregation commands, regardless of the specific version, as long as authentication is enabled. No version-specific information is provided, so all current releases that expose the aggregation interface are at risk until addressed by an update from MongoDB.

The CVSS score of 5.3 indicates a medium severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild at this time, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be local or network-based to an authenticated user on the deployed database, with no indication of remote unauthenticated exploitation. If an attacker can obtain credentials—even low-level ones—they can trigger a server crash, resulting in downtime and potential operational impact.