Numeric Truncation Vulnerability in MongoDB C++ Driver's BSON Library

CVE-2026-84970

What is CVE-2026-84970?

The MongoDB C++ Driver's BSON library has a numeric truncation weakness in its JSON parsing component. This vulnerability allows an attacker to manipulate the text input provided to the library. When the input is exceptionally large, the library may read memory beyond the limits of the supplied buffer, potentially resulting in partial document acceptance or process termination. Importantly, this vulnerability does not require any MongoDB server access, credentials, or custom configurations; the impact is isolated to the application using the driver.

References