A vulnerability in MongoDB Server allows an authenticated user to cause a server crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This occurs due to insufficient separation between user-controlled fields and internal metadata, leading to potential denial of service and integrity violations.

MongoDB Server is affected. No specific version information is provided in the available data, so all releases of MongoDB Server potentially carry this issue until a fix is applied.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, so exploitation likelihood is uncertain, but the vulnerability requires authentication, implying that an attacker must have valid credentials or gain access through other means. The issue is not listed in CISA's KEV catalog, suggesting that there are no confirmed widespread attacks yet. The vulnerable paths involve writing documents with $‑prefixed fields that the server treats as internal metadata, leading to a crash or incorrect responses during query execution.