Vulnerability · Published Apr 13, 2026 · Assigned by mongodb

CVE-2026-6231bson_validate may skip validation when processing certain inputs

Medium 4.3

In plain English

A medium-severity improper input validation in C Driver from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 91.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	mongo-c-driver	1.23.1-1+deb12u3	DEBIAN-CVE-2026-6231
Debian:13	mongo-c-driver	1.30.4-1+deb13u2	DEBIAN-CVE-2026-6231
Debian:14	mongo-c-driver	2.1.0-1	DEBIAN-CVE-2026-6231
Ubuntu:25.10	mongo-c-driver	no fix listed	UBUNTU-CVE-2026-6231

Affected products (as reported)

Vendor	Product	Versions
MongoDB Inc.	C Driver	1.0 – before 1.30.52.0 – before 2.0.2

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://jira.mongodb.org/browse/CDRIVER-6017 issue-tracking