CVE-2026-106435: fallo de gravedad media en MongoDB Python Driver
Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
Publicada el
10Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
MongoDB · Python DriverCVEs relacionadas — MongoDB Python Driver
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-88029MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python DriverEPSS 0.3%CVE-2026-96748HIGHConnection redirection via percent-encoded delimiter injection in connection string hostsEPSS 0.3%CVE-2026-96749HIGHHeap out-of-bounds write via signed size overflow in BSON document encodingEPSS 0.1%CVE-2026-96747MEDIUMForced local Unix socket connection via dot-sock KMS endpoint in client-side field encryptionEPSS 0.1%
Referencias
https://jira.mongodb.org/browse/PYTHON-6110