CVE-2026-106435CWE-125
CVE-2026-106435
Medium · published October 9, 2026
What it is
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
The record
Technical detail
- CVSS v3.1
- 5.1 · MEDIUM
- Vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4.0
- 5.9 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.00093 · 0.5th percentile
- Weakness
- CWE-125 · Out-of-bounds Read
- Published
- 2026-10-09T01:17Z
Affected products (1)
| Product | Versions | Fixed in |
|---|
| mongodb/python_driver | < 4.18.3 | 4.18.3 |
References (1)
EPSS history
Timeline
10 OCT 03:27Z
EPSS moved — → 0%
epss
08 OCT 20:12Z
Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
cvelistv5
08 OCT 20:12Z
Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
cvelistv5