The vulnerability allows attackers to cause MongoDB Server to crash by submitting a specially crafted aggregation request that includes fromRouter:true and runtimeConstants.userRoles. This results in a server crash, leading to denial of service for all applications using that instance. The flaw is due to an improper handling of certain aggregation parameters (CWE‑617).

The affected product is MongoDB Server. No specific version numbers are disclosed in the advisory. All deployments that could run arbitrary aggregation commands are potentially impacted.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need network access to submit the malicious aggregation request, most likely over the normal mongod port. Once executed, the server crashes, causing downtime until a restart.