Executive brief
A vulnerability in the MongoDB C Driver's data validation component could allow malformed data to bypass security checks. This driver is used by applications to communicate with MongoDB databases. If exploited, an attacker could submit invalid data that the system incorrectly treats as safe, potentially leading to data integrity issues or unexpected application behavior.
Technical details
A logic error exists in the bson_validate function family where the BSON_VALIDATE_UTF8 flag is effectively ignored. The underlying bson_iter_visit_all function identifies invalid UTF-8 sequences and sets an internal error offset (err_off), but the validation functions fail to check this offset. Instead, they terminate processing early upon encountering invalid sequences and return a success status. This allows malformed BSON data or invalid UTF-8 sequences in keys or strings to bypass validation. The issue is fixed in versions 1.30.5, 2.0.2, and 2.1.0.
Affected products
- MongoDB C Driver < 1.30.5, 2.0.0, 2.0.1
Timeline
- 2025-05-19: other: Issue reported in MongoDB Jira
- 2025-06-09: patched: Issue resolved in development
- 2026-04-13: advisory: CVE published