Quick answers
- Is CVE-2026-114644 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114644 being exploited in the wild.
- How severe is CVE-2026-114644?
- Medium severity, with a CVSS score of 5.9, published 22 October 2026.
- Which products and versions are affected?
- MongoDB C Driver prior to 3.13.0.
- Is there a fix for CVE-2026-114644?
- Yes: fixed in 3.13.0. Until then: Disable deserialization of untrusted BSON or JSON content until the driver can be upgraded to version 3.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114644 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-114644?
- Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 3.13.0
Disable deserialization of untrusted BSON or JSON content until the driver can be upgraded to version 3.13.0 or later.
Technical details
The BSON library uses a static, unbounded symbol table (BsonSymbolTable) during deserialization that retains interned symbols for the process lifetime with no clearing or garbage collection. An unauthenticated remote attacker who can cause untrusted BSON or JSON content to be deserialized can trigger unbounded memory growth by sending distinct symbol values that accumulate in this static dictionary. The fix removes symbol interning entirely; BsonSymbol values are no longer cached.
Affected products
- MongoDB C# Driver prior to 3.13.0
Timeline
- 2026-10-22: disclosed
- 2026-10-22: patched: MongoDB C# Driver 3.13.0 released