The vulnerability arises when the server processes a change stream with the exchange option and the resharding resume token; the implementation hits an invariant that causes the server to crash. No special privileges are required, but the user must be authenticated, meaning any logged‑in user can trigger the crash. This results in denial of service, interrupting normal database operations and potentially affecting availability of the affected system.

MongoDB Server is affected. The flaw manifests in any deployment that uses $changestreams together with the exchange option and the $_requestReshardingResumeToken parameter. Version information was not provided, so the impact applies to all releases that include the relevant code paths until patched.

The CVSS score of 7.1 classifies the issue as high severity, and the EPSS score is not available, indicating uncertainty about exploitation frequency. The vulnerability is not listed in the CISA KEV catalog. As it requires authentication, the likely attack vector is an authenticated user, potentially internal or compromised, who can issue a change‑stream command. Because no higher privileges are needed, the risk is primarily to availability rather than confidentiality or integrity.