CVE-2026-106435: MongoDB Python Driver buffer over-read in BSON regex parsing

CVE-2026-106435 · Severity: high · CVSS 5.1 · Published 2026-10-08

The MongoDB Python Driver's C extension can crash an application when it decodes malformed BSON data containing a truncated regular-expression element. An attacker who can supply BSON data to the driver's decode or decode_all function may cause the application process to terminate abruptly, resulting in a denial of service. This affects applications that decode BSON from untrusted sources, particularly from memory-mapped files or buffers without safety sentinels.

Technologies: MongoDB Python Driver, pymongo (PyPI). Vendors: MongoDB, PyPI.

Quick answers

Is CVE-2026-106435 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106435 being exploited in the wild.
How severe is CVE-2026-106435?
High severity, with a CVSS score of 5.1, published 8 October 2026.
Which products and versions are affected?
MongoDB PyMongo 0.10.3 through 4.18.2; pymongo (PyPI) >= 3.9.0, <= 4.18.2, ECOSYSTEM:introduced=3.9.0,fixed=4.18.3.
Is there a fix for CVE-2026-106435?
Yes. pymongo (PyPI): upgrade to 4.18.3 or later. Until then: Disable the C extension by setting the environment variable PYMONGO_C_EXT_ONLY=0, which will fall back to the pure-Python BSON decoder that is not vulnerable to this issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106435 attacked?
It is attacked over the network.
Am I affected by CVE-2026-106435?
Check whether you run MongoDB PyMongo, MongoDB Python Driver or pymongo (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pymongo (PyPI): upgrade to 4.18.3 or later
    pip install "pymongo>=4.18.3"

Disable the C extension by setting the environment variable PYMONGO_C_EXT_ONLY=0, which will fall back to the pure-Python BSON decoder that is not vulnerable to this issue.

Technical details

A CWE-125 out-of-bounds read vulnerability exists in the C extension's get_value function (case 11) when processing BSON Regex elements. The code calls strlen twice on the element value before validating the buffer bounds, causing reads past the document's end when the regex is truncated and lacks a trailing NUL terminator. Only the C extension is affected; the pure-Python fallback copies input before decoding and is safe. The defect does not affect MongoDB's wire protocol path, which uses bytearray buffers with safety sentinels.

Affected products

  • MongoDB PyMongo 0.10.3 through 4.18.2

Identifiers

  • CVE-2026-106435
  • GHSA-98qm-wvgf-w4cf

Timeline

  • 2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.