A vulnerability in the MongoDB BI Connector allows unauthenticated remote attackers to trigger a denial of service by exhausting available connection slots through incomplete authentication requests.

The flaw is caused by a lack of time bounds or deadlines in the SASL-based authentication negotiation loop, allowing an unauthenticated attacker to hold connection slots open indefinitely.

This vulnerability poses a significant risk to operational continuity, as it allows a remote attacker to render the BI Connector unavailable to legitimate users. With a CVSS score of 7.5, the high severity reflects the ease of exploitation, as it requires no authentication and minimal complexity to exhaust system resources, potentially leading to a complete service outage for analytics workloads.

Immediate Action: Update the MongoDB BI Connector to version 2.14.31 or later to implement the necessary connection timeouts.

Proactive Monitoring: Monitor server logs and connection metrics for an unusual accumulation of stalled or idle SASL authentication sessions.

Compensating Controls: Deploy a network-level firewall or rate-limiting solution to restrict access to the BI Connector port to trusted IP addresses only, thereby reducing the attack surface.

Public Exploit Available: No

Given the high impact on service availability and the lack of authentication required for exploitation, organizations using the MongoDB BI Connector should prioritize upgrading their instances. Applying the vendor-provided patch is the only effective way to remediate the underlying logic flaw that prevents the system from reclaiming exhausted connection resources.