CVE-2026-114646: MongoDB C# Driver BSON length validation bypass

CVE-2026-114646 · Severity: medium · CVSS 6.5 · Published 2026-10-22

The MongoDB C# Driver fails to validate that declared BSON document sizes match actual data provided, allowing an attacker to inject malicious fields into database commands without credentials. When an application accepts external binary BSON data and forwards it to MongoDB, an attacker can craft a BSON blob with a mismatched length prefix to add, remove, or modify query and update operations, potentially exposing or corrupting data within the application's database privileges.

Technologies: MongoDB C Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-114646 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114646 being exploited in the wild.
How severe is CVE-2026-114646?
Medium severity, with a CVSS score of 6.5, published 22 October 2026.
Which products and versions are affected?
MongoDB C Driver before 3.13.0.
Is there a fix for CVE-2026-114646?
Yes: fixed in 3.13.0. Until then: Writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer provided; review applications that construct RawBsonDocument, LazyBsonDocument, or RawBsonArray from external data sources and add validation before passing untrusted binary data to these constructors. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114646 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114646?
Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.13.0

Writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer provided; review applications that construct RawBsonDocument, LazyBsonDocument, or RawBsonArray from external data sources and add validation before passing untrusted binary data to these constructors.

Technical details

A data-validation flaw in raw and lazy BSON document handling in the MongoDB C# Driver fails to verify the int32 length prefix embedded in BSON binary data matches the actual buffer length. RawBsonDocument, LazyBsonDocument, and RawBsonArray constructors accept arbitrary bytes without validation; their serializers pass the slice directly to BsonBinaryWriter, which writes it verbatim to the wire without context checking. An unauthenticated attacker who can supply binary BSON content to an application can inject or absorb sibling fields in database commands via a crafted length prefix, enabling NoSQL injection attacks that bypass query scope and authorization filters.

Affected products

  • MongoDB C# Driver before 3.13.0

Timeline

  • 2026-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.