CVE-2026-6231CWE-20

bson_validate may skip validation when processing certain inputs

Medium · published April 13, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00316 · 23.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-04-13T15:31Z
EPSS history
Timeline
  • 13 APR 15:31Z
    bson_validate may skip validation when processing certain inputs
    cvelistv5