{"id":"CVE-2026-114651","kind":"vulnerability","aliases":["CVE-2026-114651"],"related":[],"title":"MongoDB C# Driver: BSON parsing can leak residual data from other requests","description":"A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.","summary":"A memory-handling flaw in the BSON deserializer of the MongoDB C# Driver can return leftover bytes from earlier processed data on the same thread. An unauthenticated sender of crafted serialized input can read limited information belonging to other requests or principals.","severity":"medium","cvss":6.3,"epss":0.00391,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backend","csharp","dotnet","mongodb","package"],"not_affected_if":["no-untrusted-bson-input"],"how_to_check":"- Check the MongoDB C# driver version referenced in the project's package manifest (for example `MongoDB.Driver` or `MongoDB.Bson` in the .csproj or packages.lock.json) and compare it with the fixed version.\n- Check whether the application maps primitive collection types during BSON deserialization, which the description says is the affected path; the sources do not name a specific setting.","fix":"- Upgrade the MongoDB C# Driver (`MongoDB.Driver` / `MongoDB.Bson`) to the fixed version listed in the NVD entry; the exact version is unknown from the sources.","status":"open","published_at":"2026-10-22T19:17:39+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T04:01:16+00:00","updated_at":"2026-10-25T04:01:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:01:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the MongoDB C# Driver (`MongoDB.Driver` / `MongoDB.Bson`) to the fixed version listed in the NVD entry; the exact version is unknown from the sources.","reach":"internet","title":"MongoDB C# Driver: BSON parsing can leak residual data from other requests","impact":"low","summary":"A memory-handling flaw in the BSON deserializer of the MongoDB C# Driver can return leftover bytes from earlier processed data on the same thread. An unauthenticated sender of crafted serialized input can read limited information belonging to other requests or principals.","category":"package","nicknames":[],"who_cares":["csharp","dotnet","mongodb","backend"],"confidence":0.6,"needs_auth":"no","worst_case":"Limited data from other requests or users is disclosed","analyst_note":"Find the fixed driver version and the exact mapping condition in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-114651) or the MongoDB advisory it cites.","how_to_check":"- Check the MongoDB C# driver version referenced in the project's package manifest (for example `MongoDB.Driver` or `MongoDB.Bson` in the .csproj or packages.lock.json) and compare it with the fixed version.\n- Check whether the application maps primitive collection types during BSON deserialization, which the description says is the affected path; the sources do not name a specific setting.","needs_analyst":true,"not_affected_if":["no-untrusted-bson-input"],"who_is_affected":"Applications written in C# that use the MongoDB C# Driver to deserialize BSON from untrusted input and map certain primitive collection types are the exposed case. The sources do not describe a further configuration requirement. Teams using the driver only with trusted data, or not deserializing externally supplied BSON, have a lower exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":3437,"output_tokens":681,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114651':15A,18A '-2026':14A,17A 'abl':104C 'amount':146C 'applic':111C,158C,166C 'authent':160C 'backend':19B 'belong':61B,149C 'bson':4A,31B,74C 'byte':41B,121C 'c':2A,36B,80C 'caus':83C,119C 'certain':114C 'collect':116C 'compon':76C 'consum':157C 'content':90C 'craft':54B,96C 'csharp':20B 'cve':13A,16A 'data':9A,45B,84C,108C,124C 'deseri':32B,75C 'disclosur':142C 'dotnet':21B 'driver':3A,37B,81C 'earlier':43B,126C 'execut':130C 'flaw':28B 'handl':27B,70C 'inform':60B,148C 'input':56B,98C 'leak':7A 'left':85C 'leftov':40B 'legitim':136C 'limit':59B,145C 'map':113C 'may':82C 'memori':26B,69C 'memory-handl':25B,68C 'mongodb':1A,22B,35B,79C 'packag':23B 'pars':5A,100C 'parti':103C 'previous':88C 'primit':115C 'princip':66B,154C 'privileg':163C 'process':44B,89C,125C 'read':58B 'request':12A,64B,152C 'requir':168C 'residu':8A,120C 'result':140C 'return':39B,93C 'sender':52B 'serial':55B,97C,107C 'special':95C,162C 'suppli':106C 'surfac':134C 'thread':49B,131C 'type':117C 'unauthent':51B,102C 'unrel':123C 'valu':137C 'weak':71C 'within':164C","nicknames":[],"mitigations":[],"who_affected":"Applications written in C# that use the MongoDB C# Driver to deserialize BSON from untrusted input and map certain primitive collection types are the exposed case. The sources do not describe a further configuration requirement. Teams using the driver only with trusted data, or not deserializing externally supplied BSON, have a lower exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114651","severity":null,"published_at":"2026-10-22T19:17:39+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114651","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114651","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}