CVE-2026-84970mediumCWE-681

CVE-2026-84970: medium-severity vulnerability in MongoDB C++ Driver

Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser

Published

Follow this CVE+ Monitor C Driver+ Monitor mongo-cxx-driver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.1%
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Affected products
MongoDB · C++ Driver
Related CVEs — MongoDB C++ Driver

In the same product, most dangerous first.

CVE-2026-81522HIGHCross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ DriverEPSS 0.5%CVE-2026-88034MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ DriverEPSS 0.5%CVE-2026-106430MEDIUMQuery and rename target confusion via embedded NUL truncation in MongoDB C++ DriverEPSS 0.2%CVE-2026-84966MEDIUMBSON element injection via NUL-embedded document keys in builder appendEPSS 0.1%