Live › vulnerability › GHSA-86gh-39m5-hhg6
Go to dashboardPyMongo's C BSON decoder reads past the end of a buffer when decoding a truncated regex element that lacks a trailing NUL byte. An attacker who can supply BSON to the decode or decode_all API can crash the application process; this advisory is withdrawn as a duplicate of GHSA-98qm-wvgf-w4cf.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:39 UTC. All times on this page are UTC.
Applications that call PyMongo's BSON decode or decode_all on bytes an outside party can supply, such as uploaded or externally fed BSON. The normal database wire-protocol path does not reach this code, so applications that only exchange data with MongoDB through the driver are not exposed by this route.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pymongo | pypi | >= 3.9.0, <= 4.18.2 | – |
pip show pymongo and compare the version to 4.18.2 or earlier.bson.decode or bson.decode_all on data from untrusted sources.pymongo past 4.18.2, the affected range given by the sources; the fixed version is unknown from this advisory, so check GHSA-98qm-wvgf-w4cf for it.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-98qm-wvgf-w4cf. This link is maintained to preserve external references.
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
This page as .md · .json · in your agent: get_signal("GHSA-86gh-39m5-hhg6")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.