An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-32036
• https://jira.mongodb.org/browse/SERVER-59294