Description
The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion failed. But PauseExecution is not a general purpose skip mechanism, but rather a TeeBuffer-internal signal used solely by $facet to coordinate its sub-pipelines. When this stage is placed before $facet in a pipeline, TeeBuffer receives the unexpected PauseExecution from upstream and hits a hard invariant assertion, crashing mongod.
Remediation
References
Related Vulnerabilities
WordPress Plugin Slimstat Analytics SQL Injection (4.9.3.2)
WordPress Plugin YITH WooCommerce Frequently Bought Together Security Bypass (1.2.10)
WildFly Application Server Uncontrolled Resource Consumption Vulnerability (CVE-2016-9589)
WordPress Plugin Remove WP Update Nags Security Bypass (1.3.0)
PHP Inadequate Encryption Strength Vulnerability (CVE-2020-7069)