Creating a "2dsphere_bucket" or "queryable_encrypted_range" index on a non-timeseries bucket collection succeeds, but any subsequent document insertion that requires index update triggers a server crash. The crash disrupts database availability, causing a denial‑of‑service condition for applications relying on the affected MongoDB instance. The vulnerability is a control‑flow disruption identified as CWE‑617.

MongoDB, Inc. MongoDB Server is affected. Vulnerable versions include 7.0.0 through 7.0.31, 8.0.0 through 8.0.20, and 8.2.0 through 8.2.5. Versions 7.0.32, 8.0.21, and 8.2.6 and later contain the fix.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation reports yet. The attack requires privileges to create an index and insert data into the target collection, and it is inferred that the threat vector is a privileged or authenticated user or an application with write access to the database, though the specific vector is not explicitly documented. Exploitation would result in an immediate crash of the mongod process, bringing the database to a non‑responsive state until a restart or recovery.