A missing limit on resource use in MongoDB’s match expression evaluator can cause the server to consume excessive memory when user-supplied query filters contain internal schema operators that are intended only for server use. When these operators are nested and applied to documents that contain arrays, the server evaluates every combination of array elements without an enforced resource limit, potentially exhausting available memory and causing the mongod process to terminate. The vulnerability can be triggered by an authenticated user with read-only privileges executing an aggregation query that nests these operators.

MongoDB Server is affected; all current versions of the product may be vulnerable unless a patch has been applied. No specific version range is disclosed in the CNA data.

The CVSS score of 7.1 indicates a high severity denial-of-service risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An exploitable attack requires an authenticated account with read-only privileges and the ability to send a specially crafted aggregation query, but no privilege escalation is required. The impact is localized to the database instance that runs out of memory, potentially affecting availability of applications that depend on it.