Threat Intelligence Database

CVE-2026-106435 is a medium severity vulnerability in the MongoDB Python Driver's binary accelerator. It involves an out-of-bounds read when decoding malformed BSON data containing a truncated regular-expression element without a trailing NUL byte. This can cause the application process to terminate if the C extension is loaded. The vulnerability is triggered only when an attacker can supply BSON to the decode or decode_all API, and does not affect the normal database wire-protocol path.

CVE-2026-96749 is an integer overflow vulnerability in the BSON document encoding component of the MongoDB Python Driver's native extension. It occurs when a single document is constructed from a very large amount of untrusted data, causing size arithmetic to overflow a signed 32-bit integer. This can lead to a write outside the bounds of an allocated buffer within the application's process. The vulnerability affects MongoDB Python Driver versions from 1.9.0 up to but not including 4.18.2. No known exploits are reported in the wild. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.5.

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.