CVE-2026-114644

MediumCVSS 5.9/10Last modified Oct 23, 2026

Description

The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MongoDBC# Driver>= 2.0.0, < 3.13.0

References

Timeline

Published
Oct 22, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1146455.2A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to CVE-2026-1146466.5A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a CVE-2026-1146474.3The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlikCVE-2026-1146487.6The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINCVE-2026-1146496.8The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached cCVE-2026-114653.1A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the filCVE-2026-1146505.9A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption CVE-2026-1146514.0A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processedCVE-2026-1146526.5A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supCVE-2026-1146536.5A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position thaCVE-2026-1146546.5A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied thCVE-2026-1146555.9libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS pro