MongoDB Server Use-After-Free Vulnerability Leading to Crash

A use-after-free vulnerability has been identified in MongoDB Server that can be triggered by an authenticated user. This vulnerability may cause the server to crash and lead to other unexpected behaviors, even if the user lacks the authorization to shut down the server. The issue arises when certain aggregation framework operations are performed using a specific combination of rarely-used pipeline expressions. Affected versions include MongoDB Server v6.0 prior to 6.0.21, v7.0 prior to 7.0.17, and v8.0 prior to 8.0.4, but only when the SBE engine is enabled.

Impact

Exploitation of this vulnerability causes a crash of the MongoDB Server, disrupting service and potentially leading to a denial of ongoing operations.