A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mongodb | Mongodb | 7.0.0 (including) | 7.0.39 (excluding) |
| Mongodb | Mongodb | 8.0.0 (including) | 8.0.28 (excluding) |
| Mongodb | Mongodb | 8.2.0 (including) | 8.2.12 (excluding) |
| Mongodb | Mongodb | 8.3.0 (including) | 8.3.7 (excluding) |