Read the docs
TI-2026-58389 Aliases CVE-2026-84966

BSON element injection via NUL-embedded document keys in builder append

Priority LOW 25CWE-681Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00142 3rd percentileScored 2026-11-07
Fix Fixed C++ Driver (MongoDB): 4.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBC++ Driver3.2.0 to before 4.5.24.5.2Patch availableCNA
  • C++ Driver VendorMongoDB Affected 3.2.0 to before 4.5.2 Fixed in 4.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:c\+\+_driver:*:*:*:*:*:mongodb:*:*3.0.0 to before 4.5.2VulnerableMongoDB
  • cpe:2.3:a:mongodb:c\+\+_driver:*:*:*:*:*:mongodb:*:* Versions 3.0.0 to before 4.5.2 Vulnerable ·MongoDB

Remediation

  • Fix · CNA C++ Driver (MongoDB) Fixed in 4.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB C++ Driver 4.5.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-58393 Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parserPriority LOW 25
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84966

References

Advisory 1

  • TI-2026-56243 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver CVSS 4.0HIGH 8.6
  • TI-2026-60059 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver CVSS 4.0MEDIUM 6.1
  • TI-2026-58393 Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences