Executive brief
libbson is a C library for parsing and generating BSON (Binary JSON) data, commonly used in MongoDB and other applications. A crafted BSON document with a zero-length prefix can trigger an integer underflow vulnerability that causes a heap out-of-bounds read, crashing applications that use the vulnerable API. This results in a denial of service for any service that accepts and processes BSON input.
Technical details
The vulnerability is an integer underflow in the bson_new_from_buffer() function caused by missing lower-bound validation on the BSON document length field. The function reads a 32-bit length from the input buffer but does not verify that the value is at least 5 bytes (the minimum valid BSON document size). When the length is zero, an array index calculation wraps to UINT32_MAX, resulting in a heap out-of-bounds read. The attack vector is network-based if BSON input is accepted over the network, and requires no authentication. An attacker can trigger a denial of service by crashing the process with specially crafted BSON data. A patch validating the minimum document length would remediate this issue.
Affected products
- MongoDB libbson
Timeline
- 2026-09-17: disclosed