MongoDB Server Denial-of-Service Vulnerability in Aggregation Trim Operators

A denial-of-service vulnerability has been identified in MongoDB Server aggregation operators $trim, $ltrim, and $rtrim. By using a densely populated character mask and a large input string, an authenticated user with aggregation permissions can cause CPU utilization to spike to 100% for an extended period. This issue affects MongoDB Server versions 7.0 prior to 7.0.34, 8.0 prior to 8.0.23, 8.2 prior to 8.2.9, and 8.3 prior to 8.3.2.

Impact

Exploitation of this vulnerability leads to a significant increase in CPU usage, causing potential performance degradation on the affected server.

Remediation

Users can upgrade to MongoDB Server versions 8.3.0-rc0, 8.2.8, 8.0.22, or 7.0.34 to address this vulnerability.