MongoDB Out-of-Memory Crash Vulnerability in Query Planner

A vulnerability in the MongoDB Query Planner can lead to excessive memory consumption, causing an out-of-memory crash. This issue arises from complex queries that the query planner processes, which can overwhelm system resources.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by leading the MongoDB server to run out of memory and crash.

Reproduction

To reproduce this vulnerability, create a collection and insert a document. Then, run one of the queries mentioned in the related Jira issue SERVER-113877, which will trigger the excessive memory usage in the query planner.

Remediation

Users can upgrade to MongoDB versions 8.3.0-rc0, 8.2.4, or 8.0.18 to address this vulnerability.