An authorized user can invoke a server crash by supplying a $geoNear aggregation pipeline that includes an invalid index hint. This flaw does not directly leak data or allow code execution; instead it disrupts the availability of the MongoDB instance by causing an unhandled exception during index processing. The underlying weakness maps to CWE‑617, where a function’s return value or error state is ignored, allowing the system to continue operating in an inconsistent state.

This issue affects MongoDB Server as distributed by MongoDB Inc. The vulnerability is applicable to all current releases in which custom $geoNear index hints are permitted; specific affected versions are not enumerated, so all supported MongoDB Server versions should be considered potentially vulnerable until a patch is released.

The CVSS base score is 7.1, indicating a medium‑to‑high severity vulnerability. EPSS indicates a exploitation probability of less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need authorized access to run the problematic pipeline, so an insider or compromised admin account is sufficient. The flaw can be exploited by executing a small aggregating query, but no remote code execution or privilege escalation is required. Systems with high uptime requirements should prioritize remediation.