CVE-2026-84970Medium· 6.2▾ SunlitA numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that tex…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.10%
0.10% → 0.1%
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.
c++_driver >= 3.2.0, < 4.5.2Upgrade past the affected range:
c++_driver 4.5.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84966Medium· 5.1An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly
CVE-2026-114654Medium· 6.5BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
CVE-2026-106432Low· 3.6The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation
CVE-2026-84963Medium· 5.3An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation …
CVE-2026-88034High· 8.3Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal iden…
CVE-2026-81522High· 8.1A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers