This is a use-after-free vulnerability in MongoDB's geospatial validator path that requires immediate attention if your deployment uses 2dsphere indexes. The key constraint is the "certain type of validator" phrasing—this isn't a standard JSON Schema validator. Geospatial validators must resolve geometry, consult the spatial index, and maintain references that outlive the immediate validation scope. That's where the race condition emerges: under concurrent writes, one request can invalidate an object while validation is still in-flight on another.
The write-privilege requirement is notable but shouldn't create false confidence. In most deployments, authenticated access is the baseline—not a meaningful barrier. The concurrency requirement is the real constraint, which means the vulnerability likely survives because the race window exists specifically in the validation path during concurrent mutation.
The blast radius extends beyond server crash. When the geospatial validator dereferences a freed pointer, you're not getting a clean transaction rollback—you're getting process death that severs every client connection simultaneously. In a replica set, the primary crash triggers election behavior, forcing failover latency onto all clients. In multi-tenant deployments running a single mongod instance, one user's trigger takes down operations for every tenant.
Check whether your deployment uses 2dsphere indexes with custom validators. Enforce least-privilege on user roles to restrict write access. Monitor mongod logs for SIGSEGV crashes correlated with geospatial queries—this is your detection signal. If you run replica sets, treat this as a failover-controllability issue rather than pure denial of service: a capable adversary who can reliably crash the primary under specific concurrent conditions is controlling election timing, not just causing downtime.