Executive brief
MongoDB's C++ Driver contains a bug in how it handles field names when building BSON documents. When an application passes an extremely large field name (over 2 GB), the driver misinterprets the field length and may read memory outside its buffer, causing the application to crash. This could disrupt applications that rely on the driver, though it requires the application to pass such oversized names, which is unusual in normal usage.
Technical details
An incorrect cast of a size_t value to int32_t in the BSON document builder's append function causes integer truncation. When a field name exceeds 2^31 bytes, the truncated value becomes negative. The underlying libbson library interprets negative lengths as a signal to use strlen() on the unterminated key, triggering a heap buffer overflow read. The vulnerability is in the bsoncxx::builder::basic namespace and affects the core append operation. While no authentication is required, the calling application must explicitly supply an oversized field name in a specific form to trigger the issue. The vendor has fixed this in version 4.5.2.
Affected products
- MongoDB C++ Driver 3.0.0 to before 4.5.2
Timeline
- 2026-09-03: disclosed
- 2026-09-04: patched: Fixed in version 4.5.2