Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-84963 EUVD-2026-70515

Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

Published Sep 3, 2026 · Updated Sep 3, 2026 · Assigned by mongodb

Description

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

Affected products

VendorProductAffectedFixed
MongoDB C Driver 1.10.0 – < 1.30.9, 2.0.0 – < 2.5.2 1.30.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 mongo-c-driver 2.5.2-1 —
Debian 13 mongo-c-driver No fix yet —
Debian 12 mongo-c-driver No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mongo-c-driver No fix yet —
Ubuntu 26.04 LTS mongo-c-driver No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS mongo-c-driver No fix yet —
Ubuntu Pro 22.04 LTS mongo-c-driver No fix yet —
Ubuntu Pro 20.04 LTS mongo-c-driver No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed mongo-c-driver 2.5.2-1.1 openSUSE-SU-2026:11706-1
ReleasePackageFixed inAdvisory
Alpine v3.24 mongo-c-driver 1.30.14-r0 —

Advisories 2

References