{"id":"CVE-2026-126839","title":"Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization","summary":"A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identif…","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-502"],"vendor":"MongoDB","product":"C# Driver","affected":["c_driver >= 2.21.0 < 3.14.0"],"published":"2026-11-12","updated":"2026-11-12","sourceUpdated":"2026-11-12T23:58:16.490Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-126839","references":[{"url":"https://jira.mongodb.org/browse/CSHARP-6169"}],"tags":["cve.org"],"ingestedAt":"2026-11-13T00:18:16.515Z","slug":"CVE-2026-126839","body":"## Overview\n\nA deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required.\n\n## Affected\n\n- `c_driver >= 2.21.0 < 3.14.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}