This vulnerability arises from the BSON validation logic in MongoDB Server where certain nested binary data structures cause uncontrolled mutual recursion between validation functions. Each recursive call resets internal depth tracking, allowing an unauthenticated attacker to crash the mongod process by sending a crafted message. The issue is classified under CWE-674 (Uncontrolled Recursion). The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, no privileges or user interaction required, and high impact on availability. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

An unauthenticated attacker can cause a denial of service by crashing the MongoDB server process (mongod), impacting availability. There is no indication of data confidentiality or integrity compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is stated, users should monitor MongoDB's official advisories for updates. Until a fix is available, consider restricting network access to MongoDB instances to trusted sources to reduce exposure to unauthenticated attacks.