This vulnerability (CVE-2026-6914) involves an integer underflow (CWE-191) triggered during the computation of an MD5 checksum on a malformed BSON object in MongoDB Server. Affected versions include all 8.1 and 8.2 releases, 8.0 versions prior to 8.0.21, and 7.0 versions prior to 7.0.32. The integer underflow can lead to loss of availability of the MongoDB server, indicating a denial-of-service condition. The CVSS 4.0 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. No official remediation or patch is currently documented, and this is not a cloud service vulnerability.

Successful exploitation of this vulnerability can cause the MongoDB server to become unavailable, resulting in a denial-of-service condition. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to MongoDB servers to trusted users and networks to reduce exposure to malformed BSON objects. Monitor vendor communications for updates on patches or mitigations.