An authenticated user can trigger excessive memory consumption by executing bitwise match expressions such as $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear during AST processing. The resulting memory pressure can lead to an out‑of‑memory condition, potentially causing the database instance to become unavailable or crash. This is a type of resource exhaustion vulnerability classified as CWE‑1325, where improper handling of input leads to uncontrolled resource usage.

MongoDB Server versions prior to 7.0.34, 8.0.23, 8.2.9, and 8.3.2 from MongoDB, Inc. are affected. These include all releases within the 7.x, 8.x, and 8.3 major lines that have not applied the specified patch levels.

The risk is therefore high for environments where authentication is compromised or where users possess broad query rights, especially in production deployments with high traffic. Monitoring for abnormal memory consumption and applying a fix mitigates the risk.