This vulnerability (CVE-2026-13074) in MongoDB Server involves allocation of resources without limits or throttling (CWE-770). An unauthenticated attacker can exploit the awaitable hello command in exhaust mode by sending a crafted combination of parameters that causes the server to enter a response loop. This loop bypasses normal throttling mechanisms, resulting in excessive CPU usage and potential degradation of server availability. The vulnerability affects multiple versions of MongoDB Server, including 7.0, 8.0, 8.2.0, and 8.3.0. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

The impact of this vulnerability is a denial-of-service condition caused by excessive CPU consumption on the MongoDB server. Because the attack requires no authentication and bypasses throttling, even a small number of malicious connections can degrade server availability. This could disrupt database operations and affect dependent applications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure of MongoDB servers to untrusted networks and monitoring for unusual CPU usage patterns related to the awaitable hello command. No official remediation or temporary fix is currently documented.