{"id":"CVE-2026-114654","kind":"vulnerability","aliases":["CVE-2026-114654"],"related":[],"title":"MongoDB C# Driver: out-of-range BSON binary subtype bypasses integrity checks","description":"A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.","summary":"A numeric conversion flaw in the BSON library of the MongoDB C# Driver lets a crafted binary subtype value from text input skip integrity checks. Encoding then writes malformed binary elements that readers reject or misread as shorter than the validated data.","severity":"medium","cvss":6.9,"epss":0.00349,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bson","csharp","dotnet","mongodb","package"],"not_affected_if":["no-untrusted-text-to-bson-binary"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-22T19:17:39+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:38:51+00:00","updated_at":"2026-10-25T03:38:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:38:51Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"MongoDB C# Driver: out-of-range BSON binary subtype bypasses integrity checks","impact":"low","summary":"A numeric conversion flaw in the BSON library of the MongoDB C# Driver lets a crafted binary subtype value from text input skip integrity checks. Encoding then writes malformed binary elements that readers reject or misread as shorter than the validated data.","category":"package","nicknames":[],"who_cares":["mongodb","csharp","dotnet","bson"],"confidence":0.5,"needs_auth":"no","worst_case":"malformed data persisted and misread by downstream readers","analyst_note":"Find affected driver version range and fixed release in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114654 and the MongoDB advisory it links.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-untrusted-text-to-bson-binary"],"who_is_affected":"Applications built on the MongoDB C# Driver that parse untrusted text into BSON binary values and then store or encode them. Applications that never feed untrusted text into binary subtype fields have less exposure. The sources do not name affected driver versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00058,"input_tokens":3449,"output_tokens":471,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114654':16A,19A '-2026':15A,18A 'abl':134C 'affect':141C 'allow':83C 'applic':142C 'binari':9A,41B,54B,89C,103C,123C,151C 'binary-el':102C 'bson':8A,20B,31B,75C 'bypass':11A,98C 'c':2A,36B,81C 'caus':144C 'check':13A,49B,106C 'convers':27B,71C 'craft':40B 'csharp':21B 'cve':14A,17A 'data':66B,152C,168C 'dotnet':22B 'driver':3A,37B,82C 'either':156C 'element':55B,104C,124C 'emit':147C 'encod':50B,113C 'error':160C 'flaw':28B,72C 'handl':76C 'input':46B,96C 'integr':12A,48B,105C 'interpret':163C 'later':112C 'length':130C 'let':38B 'librari':32B,77C,100C 'malform':53B,150C 'misdeclar':126C 'misread':60B 'mongodb':1A,23B,35B,80C 'narrow':116C 'numer':26B,69C 'numeric-typ':68C 'out-of-rang':4A,85C 'packag':24B 'pars':138C 'parti':133C 'persist':149C 'produc':122C 'rang':7A,88C 'reader':57B,155C 'reject':58B,157C 'represent':121C 'shorter':62B,165C 'silent':162C 'skip':47B 'smaller':119C 'subsequ':154C 'subtyp':10A,42B,90C 'suppli':92C,136C 'text':45B,137C 'textual':95C 'type':70C,128C 'unauthent':132C 'untrust':94C 'valid':65B,171C 'valu':43B,91C,110C 'wire':120C 'write':52B","nicknames":[],"mitigations":[],"who_affected":"Applications built on the MongoDB C# Driver that parse untrusted text into BSON binary values and then store or encode them. Applications that never feed untrusted text into binary subtype fields have less exposure. The sources do not name affected driver versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114654","severity":null,"published_at":"2026-10-22T19:17:39+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114654","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114654","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}