Live › vulnerability › CVE-2026-114651
Go to dashboardA memory-handling flaw in the BSON deserializer of the MongoDB C# Driver can return leftover bytes from earlier processed data on the same thread. An unauthenticated sender of crafted serialized input can read limited information belonging to other requests or principals.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications written in C# that use the MongoDB C# Driver to deserialize BSON from untrusted input and map certain primitive collection types are the exposed case. The sources do not describe a further configuration requirement. Teams using the driver only with trusted data, or not deserializing externally supplied BSON, have a lower exposure.
No product ranges from the sources yet.
MongoDB.Driver or MongoDB.Bson in the .csproj or packages.lock.json) and compare it with the fixed version.MongoDB.Driver / MongoDB.Bson) to the fixed version listed in the NVD entry; the exact version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.
This page as .md · .json · in your agent: get_signal("CVE-2026-114651")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.