A flaw in MongoDB Server’s query planner occurs when parsing a sort pattern in raw BSON form. If the sort pattern contains a $meta expression, the planner incorrectly transforms the expression, triggering an invariant failure that crashes the mongod process. The result is a denial of service, interrupting database availability for the affected instance.

MongoDB Server is the impacted product. No specific product version information was supplied, so all versions released around the time of the advisory may be affected until a vendor update is applied.

The CVSS score of 7.1 indicates moderate to high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote attacker submitting a crafted query that includes a $meta sort expression to a MongoDB instance that accepts arbitrary query inputs. Because the flaw resides in the query planner rather than authentication or authorization controls, an attacker can trigger the crash without local privileges. This inference is based on the description of the flaw affecting the query planner during query planning.