Threats tagged 'brew-mongo-orchestration-cve-2026-106435'

A vulnerability in the MongoDB Python Driver's C extension BSON decoder allows an out-of-bounds read when decoding a malformed Regex element from certain buffer types. This can cause the process to crash with an uncatchable SIGSEGV, impacting availability. The issue affects all releases through 4.18.2 when the C extension is loaded. The vulnerability is fixed in PyMongo 4.18.3. Applications decoding untrusted BSON from non-NUL-terminated buffers such as mmap or array buffers are vulnerable. Using NUL-terminated buffers or upgrading to the fixed version mitigates the issue.