This vulnerability arises from the MongoDB server's JSON Pointer parser not enforcing adequate limits on iteration count or total allocation size when processing $jsonSchema query filters. Specifically, a specially crafted $jsonSchema filter in a find command can cause significant memory amplification. When multiple such requests occur concurrently, the cumulative memory consumption can exhaust the server's heap memory, causing the mongod process to be terminated by the out-of-memory handler and denying service to all connected clients. The affected versions explicitly include MongoDB Server versions 7.0.0, 8.0.0, and 8.3.0. The CVSS 4.0 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required beyond low, no user interaction, and high impact on availability.

Successful exploitation leads to denial of service by exhausting heap memory on the MongoDB server, causing the mongod process to terminate and disconnect all clients. This impacts availability but does not indicate confidentiality or integrity compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented as of the published date. Until a patch is available, consider limiting exposure of MongoDB servers to untrusted users and monitoring for unusual memory usage patterns during $jsonSchema queries.