MongoDB Server has a NULL pointer dereference vulnerability (CWE-476) triggered during the processing of malformed OCSP responses in outbound TLS connections. When the server initiates a TLS handshake and receives a malformed OCSP response from a remote peer, it may crash due to improper handling of the response. OCSP stapling validation is enabled by default for outgoing connections, increasing exposure in scenarios where the remote peer holds a certificate from the cluster's trusted CA or the connection traverses untrusted networks. The vulnerability affects specific MongoDB Server versions 7.0, 8.0, 8.2.0, and 8.3.0. No official patch or remediation guidance has been published yet.

Successful exploitation causes the MongoDB server to terminate abnormally (crash) during outbound TLS handshakes with certain remote peers. This can lead to denial of service conditions affecting availability. There is no indication of code execution or data compromise from the provided data. The vulnerability requires specific conditions related to certificate trust and network path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting outbound TLS connections to trusted peers and monitoring for abnormal server terminations related to TLS handshakes. No official remediation or temporary fix has been published by MongoDB at this time.