Skip to content
OpenAdvisories
Low · 3.7 CVE-2026-84969 EUVD-2026-70508GHSA-9xr7-hhfx-wh4c

Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output

Published Sep 3, 2026 · Updated Sep 3, 2026 · Assigned by mongodb

Description

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

Affected products

VendorProductAffectedFixed
MongoDB C Driver 1.30.0 – < 1.30.9, 2.0.0 – < 2.5.2 1.30.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 mongo-c-driver 2.5.2-1 —
Debian 13 mongo-c-driver No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 mongo-c-driver No fix yet —
Ubuntu 26.04 LTS mongo-c-driver No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS mongo-c-driver No fix yet —
Ubuntu Pro 22.04 LTS mongo-c-driver No fix yet —
Ubuntu Pro 20.04 LTS mongo-c-driver No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed mongo-c-driver 2.5.2-1.1 openSUSE-SU-2026:11706-1
ReleasePackageFixed inAdvisory
Alpine v3.24 mongo-c-driver 1.30.14-r0 —

Advisories 2

References