Bug 2548185 (CVE-2026-106431) - CVE-2026-106431 mongo-c-driver: mongo-c-driver: Denial of Service via off-by-one error in BSON bulk document writer
Summary: CVE-2026-106431 mongo-c-driver: mongo-c-driver: Denial of Service via off-by-...
Keywords:
Status: NEW
Alias: CVE-2026-106431
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2548585 2548586
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-08 19:03 UTC by OSIDB Bzimport
Modified: 2026-10-09 13:10 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-08 19:03:16 UTC
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.


Note You need to log in before you can comment on or make changes to this bug.