BSON Encoding Vulnerability in MongoDB Java Driver by MongoDB

CVE-2026-118581

What is CVE-2026-118581?

A vulnerability exists in the BSON encoding component of the MongoDB Java Driver, which fails to validate the self-declared length of externally supplied raw documents before copying them into outgoing database commands. This oversight allows malicious applications to manipulate documents, leading to the potential execution of unintended commands by the database. As a result, unauthorized data modifications could occur under the application's credentials without requiring authentication or user interaction.

References