Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser (MongoDB C++ Driver)

CVE-2026-84970
MEDIUM 5.9

En bref

Source
NVD
EPSS
EPSS 0.12 % · centile 2 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
mongodb
Statut NVD
Analyzed

Description

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

Faiblesses (CWE)

  • CWE-681 — Incorrect Conversion between Numeric Types

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 4.0MEDIUM 5.9CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:Nmongodb
CVSS 3.1MEDIUM 6.2CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:Hmongodb
CVSS 4.0MEDIUM 5.9CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · cna@mongodb.com (Secondary)
CVSS 3.1MEDIUM 6.2CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:HNVD · cna@mongodb.com (Secondary)
CVSS 3.1MEDIUM 5.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
MongoDB · C++ Driveraffected 3.2.0 < 4.5.2

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD