Vulnerability · Published Sep 3, 2026 · Assigned by mongodb
CVE-2026-84966BSON element injection via NUL-embedded document keys in builder append
Medium 5.1
In plain English
A medium-severity security flaw in C++ Driver from MongoDB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | mongo-cxx-driver | 4.5.2-1 | DEBIAN-CVE-2026-84966 |
| Ubuntu:26.10 | mongo-cxx-driver | no fix listed | UBUNTU-CVE-2026-84966 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB | C++ Driver | 3.2.0 – before 4.5.2 |
Weakness: CWE-681 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H