Live › vulnerability › CVE-2026-114654
Go to dashboardA numeric conversion flaw in the BSON library of the MongoDB C# Driver lets a crafted binary subtype value from text input skip integrity checks. Encoding then writes malformed binary elements that readers reject or misread as shorter than the validated data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on the MongoDB C# Driver that parse untrusted text into BSON binary values and then store or encode them. Applications that never feed untrusted text into binary subtype fields have less exposure. The sources do not name affected driver versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.
This page as .md · .json · in your agent: get_signal("CVE-2026-114654")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.