The vulnerability stems from MongoDB Server’s internal locking mechanism, which uses an encoded resource identifier to decide which lock to acquire. If two collections generate the same encoded identifier, the resulting lock collisions can render one or both collections unavailable. This flaw represents a concurrency issue (CWE-412) that can lead to service interruption for affected collections.

MongoDB Server accounts for all versions of the product, with no specific affected version range announced. Any deployment using the internal locking system is potentially susceptible to this collision behavior.

The CVSS score of 7.1 indicates moderate severity. The EPSS score of less than 1% suggests exploitation probability is currently low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be internal or local, as the issue requires concurrent operations that share the same internal resource identifier; details on external exploitation are not provided. Exploitation would involve orchestrating parallel workloads that collide on the encoded resource IDs, thereby triggering lock conflicts and rendering collections temporarily unavailable.