Read the docs
TI-2026-58386 Aliases CVE-2026-84963

Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

Priority LOW 34CWE-681Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 24th percentileScored 2026-11-07
Fix Fixed C Driver (MongoDB): 1.30.9, 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBC Driver1.10.0 to before 1.30.9; 2.0.0 to before 2.5.21.30.9, 2.5.2Patch availableCNA
  • C Driver VendorMongoDB Affected 1.10.0 to before 1.30.9; 2.0.0 to before 2.5.2 Fixed in 1.30.9, 2.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*1.10.0 to before 1.30.9; 2.0.0 to before 2.5.2VulnerableMongoDB
  • cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:* Versions 1.10.0 to before 1.30.9; 2.0.0 to before 2.5.2 Vulnerable ·MongoDB

Remediation

  • Fix · CNA C Driver (MongoDB) Fixed in 1.30.9, 2.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB C Driver 1.30.9, 2.5.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-58387 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS clientPriority LOW 35
    • TI-2026-58392 Heap overflow via truncated base64 encoding of binary fields in length-limited JSON outputPriority LOW 28
    • TI-2026-58388 Heap write primitive via size round-up wrap during JSON parsing on 32-bit buildsPriority LOW 25
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84963

References

Advisory 1

  • TI-2026-62966 Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream CVSS 4.0CRITICAL 9.2
  • TI-2026-05870 MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow CVSS 4.0HIGH 8.6
  • TI-2026-62968 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() CVSS 4.0MEDIUM 6.9
  • TI-2024-07001 Accessing Untrusted Directory May Allow Local Privilege Escalation CVSS 3.1HIGH 7.8
  • TI-2026-58387 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client CVSS 4.0HIGH 8.2
  • TI-2023-00414 MongoDB client C Driver may infinitely loop when validating certain BSON input data CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences