This vulnerability in MongoDB Server involves a reachable assertion triggered by adding fromRouter:true and runtimeConstants.userRoles parameters, which causes aggregation queries to crash the server. It is identified as CWE-617, indicating an assertion failure reachable during execution. The CVSS 4.0 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability. The affected versions explicitly include 7.0.0, 8.0.0, 8.2.0, and 8.3.0. No remediation level or patch information is provided, and the vendor has not indicated an official fix yet.

Successful exploitation causes the MongoDB server to crash during aggregation operations, leading to denial of service. The vulnerability does not require user interaction or elevated privileges, making it potentially easier to exploit remotely. The impact is limited to availability, with no indication of confidentiality or integrity compromise. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor MongoDB server behavior and avoid using the combination of fromRouter:true and runtimeConstants.userRoles in aggregation queries if possible. No official mitigation or workaround has been provided by the vendor at this time.