Skip to content
OpenAdvisories
Medium · 5.1 CVE-2026-106435 EUVD-2026-95254GHSA-86gh-39m5-hhg6GHSA-98qm-wvgf-w4cf

Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

Published Oct 8, 2026 · Updated Oct 9, 2026 · Assigned by mongodb

Description

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.

Affected products

VendorProductAffectedFixed
MongoDB Python Driver 0.10.3 – ≤ 4.18.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 pymongo 4.19.0-1 —
Debian 13 pymongo No fix yet —
Debian 12 pymongo No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pymongo No fix yet —
Ubuntu 26.04 LTS pymongo No fix yet —
Ubuntu 24.04 LTS pymongo No fix yet —
Ubuntu 22.04 LTS pymongo No fix yet —
Ubuntu 20.04 LTS pymongo No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS pymongo No fix yet —
Ubuntu Pro 18.04 LTS pymongo No fix yet —
Ubuntu Pro 16.04 LTS pymongo No fix yet —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-pymongo No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling datadog-agent-7.78-core-integrations +3 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI pymongo >= 3.9.0, < 4.18.3 4.18.3 GHSA-98qm-wvgf-w4cf

Advisories 1

References