Live › vulnerability › CVE-2026-114644
Go to dashboardThe MongoDB C# Driver's BSON library retains data from each deserialized value of one BSON type for the life of the process, with no cap. An unauthenticated remote party who can get untrusted content deserialized can exhaust the host application's memory and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built with the MongoDB C# Driver's BSON library that deserialize content an outside party can supply, such as API request bodies or uploads. Services that only read data from trusted internal sources, or that do not use the C# driver, are not exposed. The MongoDB server itself is not affected.
No product ranges from the sources yet.
.csproj or packages.lock.json, and note the version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-114644")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.