CVE-2026-84963mediumCWE-681

CVE-2026-84963: fallo de gravedad media en MongoDB C Driver

Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

Publicada el

Seguir esta CVE+ Monitorear C Driver+ Monitorear mongo-c-driver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.3%
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
MongoDB · C Driver
CVEs relacionadas — MongoDB C Driver

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-96746HIGHHeap buffer overflow via mid-scan command list growth in client topology monitoringEPSS 0.4%CVE-2026-120678HIGHMongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)EPSS 0.4%CVE-2026-120955HIGHMongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS MetadataEPSS 0.4%CVE-2026-120684MEDIUMMongoDB C Driver GridFS gap lets a shared writer recover a protected client's passwordEPSS 0.3%CVE-2026-84969MEDIUMHeap overflow via truncated base64 encoding of binary fields in length-limited JSON outputEPSS 0.3%CVE-2026-81524MEDIUMCross-tenant database retargeting via dot/NUL injection in namespace strings in the C DriverEPSS 0.3%