Numeric Conversion Flaw in MongoDB C# Driver by MongoDB
CVE-2026-114654

6.9MEDIUM

Key Information:

Vendor

Mongodb
Status
C# Driver
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114654?

A flaw in the BSON handling library of the MongoDB C# Driver enables an out-of-range binary subtype to bypass integrity checks. When untrusted textual input is parsed, it can lead to the emission of malformed binary data. This data can be interpreted incorrectly by subsequent readers, resulting in type or length misinterpretation. Unauthenticated users who supply this input can significantly disrupt data integrity within affected applications.

Affected Version(s)

C# Driver 2.0.0 < 3.13.0

References

https://jira.mongodb.org/browse/CSHARP-6166
https://github.com/mongodb/mongo-csharp-driver/releases/t...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.