{"id":"CVE-2026-114644","kind":"vulnerability","aliases":["CVE-2026-114644"],"related":[],"title":"MongoDB C# Driver BSON library: unbounded memory growth on untrusted input","description":"The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.","summary":"The MongoDB C# Driver's BSON library retains data from each deserialized value of one BSON type for the life of the process, with no cap. An unauthenticated remote party who can get untrusted content deserialized can exhaust the host application's memory and cause a denial of service.","severity":"high","cvss":8.2,"epss":0.00481,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["csharp","dotnet","internet-facing-api","mongodb","package"],"not_affected_if":["no-untrusted-bson","other-language-driver","server-only"],"how_to_check":"- Check whether the project references the MongoDB BSON package for C# (MongoDB.Bson) in its `.csproj` or `packages.lock.json`, and note the version.\n- Check whether the application deserializes BSON from untrusted sources such as network clients or uploaded files.","fix":"- Upgrade MongoDB.Bson (MongoDB C# Driver) to the patched version listed in the NVD entry; the fixed version number is unknown from the sources.\n- Until patched, avoid deserializing untrusted BSON or put a size limit in front of the deserializer.","status":"open","published_at":"2026-10-22T19:17:38+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:03:42+00:00","updated_at":"2026-10-25T03:03:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:03:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MongoDB.Bson (MongoDB C# Driver) to the patched version listed in the NVD entry; the fixed version number is unknown from the sources.\n- Until patched, avoid deserializing untrusted BSON or put a size limit in front of the deserializer.","reach":"internet","title":"MongoDB C# Driver BSON library: unbounded memory growth on untrusted input","impact":"medium","summary":"The MongoDB C# Driver's BSON library retains data from each deserialized value of one BSON type for the life of the process, with no cap. An unauthenticated remote party who can get untrusted content deserialized can exhaust the host application's memory and cause a denial of service.","category":"package","nicknames":[],"who_cares":["csharp","dotnet","mongodb","internet-facing-api"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker exhausts host process memory, causing denial of service","analyst_note":"Check the NVD entry and the MongoDB advisory for the affected BSON type, affected version range and patched version.","how_to_check":"- Check whether the project references the MongoDB BSON package for C# (MongoDB.Bson) in its `.csproj` or `packages.lock.json`, and note the version.\n- Check whether the application deserializes BSON from untrusted sources such as network clients or uploaded files.","needs_analyst":true,"not_affected_if":["no-untrusted-bson","server-only","other-language-driver"],"who_is_affected":"Applications built with the MongoDB C# Driver's BSON library that deserialize content an outside party can supply, such as API request bodies or uploads. Services that only read data from trusted internal sources, or that do not use the C# driver, are not exposed. The MongoDB server itself is not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":3432,"output_tokens":648,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114644':14A,17A '-2026':13A,16A 'accumul':124C 'affect':166C 'api':23B 'applic':66B,98C,145C 'avail':147C 'bson':4A,31B,41B,80C,94C 'c':2A,28B,77C 'cap':51B 'caus':70B,131C 'compon':164C 'confidenti':157C 'consumpt':86C 'contain':82C 'content':60B,102C,111C,133C 'csharp':18B 'cve':12A,15A 'data':34B,107C 'deni':150C 'denial':72B 'deriv':108C 'deseri':37B,61B,90C,100C,136C 'dotnet':19B 'drive':138C 'driver':3A,29B,78C 'exhaust':63B,142C 'face':22B 'get':58B 'growth':8A,141C 'handl':91C 'host':65B,144C 'impact':155C 'input':11A 'integr':159C 'internet':21B 'internet-facing-api':20B 'librari':5A,32B,81C,105C 'life':45B 'lifetim':114C 'limit':120C 'memori':7A,68B,140C,148C 'mongodb':1A,24B,27B,76C,162C 'much':123C 'one':40B,93C 'packag':25B 'parti':55B,128C 'process':48B,117C 'remot':54B,127C 'resourc':85C 'retain':33B,106C 'server':163C 'servic':74B,151C 'type':42B,96C 'unauthent':53B,126C 'unbound':6A,139C 'uncontrol':84C 'untrust':10A,59B,101C 'valu':38B,95C 'weak':87C","nicknames":[],"mitigations":[],"who_affected":"Applications built with the MongoDB C# Driver's BSON library that deserialize content an outside party can supply, such as API request bodies or uploads. Services that only read data from trusted internal sources, or that do not use the C# driver, are not exposed. The MongoDB server itself is not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114644","severity":null,"published_at":"2026-10-22T19:17:38+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114644","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114644","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}