A malicious or careless authenticated user can construct an aggregation query that includes the $trim, $ltrim, or $rtrim operators with a densely populated character mask and a large input string. The database engine spends excessive CPU time processing each of these operators, causing the server CPU usage to spike to 100%. The attack can keep the CPU load elevated for an extended period, effectively denying service to other operations on the same server.

MongoDB Server versions prior to 7.0.34, 8.0.23, 8.2.9, and 8.3.2 are affected. The vulnerability applies to any installation of these releases that has enabled aggregation functions for authenticated users.

The CVSS base score of 5.3 indicates a moderate severity. Because the exploit requires authentication with proper aggregation permissions, the risk is limited to accounts that already possess such privileges. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, so there is no evidence of active exploitation. Nevertheless, any privileged user can self‑scope the denial-of-service for a prolonged duration, impacting availability for all users of that MongoDB instance.