CVE-2026-84963

MediumCVSS 5.3/10Last modified Sep 22, 2026

Description

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-681

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2026
Last modified: Sep 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-849647.5A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that th CVE-2026-849655.5An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a fo CVE-2026-849665.5An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interp CVE-2026-849674.3A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value CVE-2026-849685.3An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially for CVE-2026-849693.7A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a h CVE-2026-84977.4Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Andr CVE-2026-849705.8A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text CVE-2026-849716.5Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check t CVE-2026-849757.4PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib CVE-2026-849897.1ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng CVE-2026-84995.3The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and inc