Executive brief
The MongoDB BSON library contains an integer wraparound vulnerability in its JSON parsing code that causes incorrect memory allocation size calculations. An attacker can send a specially crafted JSON input to applications using the library, triggering a denial of service by crashing the application. This affects applications on 32-bit builds and requires no authentication.
Technical details
The vulnerability is an integer wraparound in an allocation size calculation within the BSON library's JSON parsing code. When processing maliciously large JSON input, the allocation size overflows on 32-bit systems, causing a buffer to be released prematurely while a subsequent copy operation still writes through the freed (stale) pointer. This results in a use-after-free condition. The attack requires only the ability to supply JSON input to an application that links the vulnerable library; no authentication is required. An unauthenticated remote attacker can trigger an unexpected application termination, causing denial of service. Patches were released in version 2.5.2 and 1.30.9 of the BSON library.
Affected products
- MongoDB BSON library before 2.5.2 and before 1.30.9
Timeline
- 2026-09-03: disclosed: Published to NVD
- 2026-09-04: patched: Fixed in versions 2.5.2 and 1.30.9