A bug in MongoDB Server 8.0 allows an aggregation stage to leave its _subPipeline field null while processing certain pipelines. When a subsequent getMore is requested on the same cursor, the server may dereference the null subPipeline during reattachment to the operation context, leading to an invalid memory access and crashing the process. The flaw is a null pointer dereference (CWE-476) and results in a denial of service that requires an authenticated user with permission to run aggregation pipelines.

MongoDB Server 8.0 is vulnerable. The issue is specific to this major version and may not affect earlier releases. Any deployment of this version that permits user-initiated aggregation pipelines is affected.

The CVSS score of 7.1 indicates a medium to high severity. An attacker needs to authenticate and have the ability to execute custom aggregation queries. The expected attack vector is remote, as long as the attacker can log in to the database with sufficient privileges. EPSS is not available and the vulnerability is not listed in KEV, but any instance that allows user‑supplied aggregation remains at risk until remedied.