A flaw in MongoDB Server’s BSON validator permits an attacker to send a specially crafted message that induces uncontrolled recursion between validation functions. Because each recursive call resets the validator’s depth counter, the call stack grows without bound until the process exhausts its memory. This results in a crash of the mongod daemon, making the database service unavailable for legitimate users until a restart occurs. The vulnerability is present before authentication, so any network user could trigger it.

The issue affects MongoDB Server installations. The affected product list does not specify particular release numbers, so all releases lacking the fix should be considered vulnerable until updated.

The CVSS score of 8.7 classifies the flaw as High severity. No EPSS data is currently available, but the lack of a KEV listing does not reduce the risk of exploitation. The likely attack vector is remote, with an unauthenticated attacker able to send a malicious BSON payload over the network to provoke the stack overflow. Once triggered, the entire mongod process terminates, leading to a denial of service. There are no known restrictions on pre‑authentication for this flaw, making it easy for threat actors to exploit from anywhere the database is exposed.