CVE-2020-7926: 
MongoDB vulnerability analysis and mitigation

MongoDB Server version 4.4.0 was found to contain a vulnerability (CVE-2020-7926) where authorized users could cause a denial of service through specially crafted database queries. The vulnerability was discovered in August 2020 and affected MongoDB Server version 4.4 prior to version 4.4.1, with earlier versions being unaffected (MongoDB Jira).

The vulnerability stems from an invariant violation in the server selection subsystem that could be triggered through specific database queries. The issue received a CVSS 3.0 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and was classified under CWE-755 (Improper Handling of Exceptional Conditions). The vulnerability specifically relates to a bug in the query planner that could trigger this invariant condition (MongoDB Jira, Vulnerability Manager).

When successfully exploited, this vulnerability could result in a denial of service condition, affecting the availability of the MongoDB server. The impact is limited to availability with no direct effect on confidentiality or integrity of the system (MongoDB Jira).

The vulnerability requires an attacker to be an authorized user with permissions to perform database queries. No public exploits were available at the time of disclosure (Vulnerability Manager).

The vulnerability was addressed in MongoDB Server version 4.4.1. Users running affected versions should upgrade to version 4.4.1 or later to mitigate this security issue (MongoDB Jira).