CVE-2026-84970
mediumpriority · track · 23EPSS 0.001 · 2 %ileDEUSEPSS · scored 2026-10-27
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 2.2–6.2
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3182MongoDB: Mehrere SchwachstellenDeutsch2026-09-03csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Treibern und einer Bibliothek ausnutzen, um Daten zu manipulieren oder offenzulegen, sowie um einen Denial of Service Zustand herbeizuführen.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
- https://jira.mongodb.org/browse/CXX-3547Vendor AdvisoryIssue Tracking
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan