---
id: "CVE-2026-114651"
kind: "vulnerability"
aliases: ["CVE-2026-114651"]
title: "MongoDB C# Driver: BSON parsing can leak residual data from other requests"
severity: "medium"
cvss: 6.3
epss: 0.00391
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["backend", "csharp", "dotnet", "mongodb", "package"]
not_affected_if: ["no-untrusted-bson-input"]
published_at: "2026-10-22T19:17:39+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T04:01:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114651", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114651", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# MongoDB C# Driver: BSON parsing can leak residual data from other requests

A memory-handling flaw in the BSON deserializer of the MongoDB C# Driver can return leftover bytes from earlier processed data on the same thread. An unauthenticated sender of crafted serialized input can read limited information belonging to other requests or principals.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the MongoDB C# driver version referenced in the project's package manifest (for example `MongoDB.Driver` or `MongoDB.Bson` in the .csproj or packages.lock.json) and compare it with the fixed version.
- Check whether the application maps primitive collection types during BSON deserialization, which the description says is the affected path; the sources do not name a specific setting.

## Fix

- Upgrade the MongoDB C# Driver (`MongoDB.Driver` / `MongoDB.Bson`) to the fixed version listed in the NVD entry; the exact version is unknown from the sources.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114651
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114651

## From the sources

A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_