{"id":"GHSA-86gh-39m5-hhg6","kind":"vulnerability","aliases":["GHSA-86gh-39m5-hhg6"],"related":[],"title":"Duplicate Advisory: PYTHON-6110 Out-of-bounds read in BSON decoding via a malformed Regex element","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-98qm-wvgf-w4cf. This link is maintained to preserve external references.\n\n## Original Description\nThe MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.","summary":"PyMongo's C BSON decoder reads past the end of a buffer when decoding a truncated regex element that lacks a trailing NUL byte. An attacker who can supply BSON to the decode or decode_all API can crash the application process; this advisory is withdrawn as a duplicate of GHSA-98qm-wvgf-w4cf.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pymongo","fixed":[],"affected":">= 3.9.0, <= 4.18.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-125","mongodb","package","pymongo","python"],"not_affected_if":["no-untrusted-bson","wire-protocol-only"],"how_to_check":"- Run `pip show pymongo` and compare the version to `4.18.2` or earlier.\n- Search the codebase for calls to `bson.decode` or `bson.decode_all` on data from untrusted sources.","fix":"- Upgrade `pymongo` past `4.18.2`, the affected range given by the sources; the fixed version is unknown from this advisory, so check GHSA-98qm-wvgf-w4cf for it.","status":"withdrawn","published_at":"2026-10-08T21:33:28+00:00","first_seen_at":"2026-10-27T15:39:16+00:00","triaged_at":"2026-10-27T15:39:47+00:00","updated_at":"2026-10-27T15:39:47+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T15:39:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `pymongo` past `4.18.2`, the affected range given by the sources; the fixed version is unknown from this advisory, so check GHSA-98qm-wvgf-w4cf for it.","reach":"unknown","title":"PyMongo: malformed BSON regex element causes out-of-bounds read and crash","impact":"low","summary":"PyMongo's C BSON decoder reads past the end of a buffer when decoding a truncated regex element that lacks a trailing NUL byte. An attacker who can supply BSON to the decode or decode_all API can crash the application process; this advisory is withdrawn as a duplicate of GHSA-98qm-wvgf-w4cf.","category":"package","nicknames":[],"who_cares":["python","pymongo","mongodb"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes the application process via malformed BSON input","analyst_note":"","how_to_check":"- Run `pip show pymongo` and compare the version to `4.18.2` or earlier.\n- Search the codebase for calls to `bson.decode` or `bson.decode_all` on data from untrusted sources.","needs_analyst":false,"not_affected_if":["wire-protocol-only","no-untrusted-bson"],"who_is_affected":"Applications that call PyMongo's BSON decode or decode_all on bytes an outside party can supply, such as uploaded or externally fed BSON. The normal database wire-protocol path does not reach this code, so applications that only exchange data with MongoDB through the driver are not exposed by this route.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3474,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125':30B '-6110':4A '39m5':21A,26A '86gh':20A,25A '98qm':87B,105C 'acceler':124C 'actor':149C 'advisori':2A,78B,91C,93C 'api':71B,161C 'applic':75B,132C,165C 'attack':60B 'binari':123C 'bound':8A 'bson':11A,38B,64B,135C,153C 'buffer':46B,129C 'byte':58B,147C 'c':37B,171C 'caus':163C 'code':188C 'contain':136C 'crash':73B 'cwe':29B 'databas':179C 'decod':12A,39B,48B,67B,69B,133C,157C,159C 'descript':117C 'document':156C 'driver':121C,176C 'duplic':1A,83B,90C,101C 'element':17A,52B,142C 'end':43B 'express':141C 'extens':172C 'extern':114C 'ghsa':19A,24A,86B,104C 'ghsa-86gh-39m5-hhg6':18A,23A 'ghsa-98qm-wvgf-w4cf':85B,103C 'hhg6':22A,27A 'lack':54B 'link':109C 'load':174C 'maintain':111C 'malform':15A,134C 'mongodb':31B,119C 'normal':178C 'nul':57B,146C 'origin':116C 'out-of-bound':5A 'outsid':127C 'packag':32B 'past':41B 'path':183C 'preserv':113C 'process':76B,166C 'protocol':182C 'pymongo':28A,33B,35B 'python':3A,34B,120C 'reach':186C 'read':9A,40B,126C 'refer':115C 'regex':16A,51B 'regular':140C 'regular-express':139C 'suppli':63B,152C 'termin':168C 'trail':56B,145C 'truncat':50B,138C 'via':13A 'w4cf':89B,107C 'wire':181C 'wire-protocol':180C 'withdrawn':80B,96C 'without':143C 'wvgf':88B,106C","nicknames":[],"mitigations":[],"who_affected":"Applications that call PyMongo's BSON decode or decode_all on bytes an outside party can supply, such as uploaded or externally fed BSON. The normal database wire-protocol path does not reach this code, so applications that only exchange data with MongoDB through the driver are not exposed by this route.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T21:33:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-86gh-39m5-hhg6","url":"https://github.com/advisories/GHSA-86gh-39m5-hhg6","severity":"medium","published_at":"2026-10-08T21:33:28+00:00","modified_at":"2026-10-27T15:36:26+00:00","first_seen_at":"2026-10-27T15:39:16+00:00","fetched_at":"2026-10-27T15:39:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}