CVE-2026-106435

What it actually does

Out-of-bounds read in the C-accelerated BSON decoder when processing a truncated regular-expression element lacking a trailing NUL byte, resulting in process termination via the documented decode/decode_all APIs.

Why it matters to the business

Applications using the Python driver with the C extension enabled can be crashed by untrusted BSON input, causing denial of service; the issue does not affect normal database communication paths.

How an attack unfolds

An attacker crafts BSON containing a malformed regex element without a trailing NUL, supplies it to an application that calls the driver's decode or decode_all functions, and triggers the out-of-bounds read that terminates the process when the C extension is active.

How to fix it

Disable the C extension by setting the environment variable PYMONGO_C_EXT=0 or installing without the C extension until a patched driver version is released; monitor the MongoDB Python driver release notes for the security update.

How to confirm the fix worked

Confirm the C extension is loaded with import pymongo; print(pymongo.has_c()); attempt to decode a test BSON payload containing a truncated regex element and verify the process no longer crashes after mitigation.

Typical attack path

1. Identify an application endpoint or API that accepts and decodes BSON via PyMongo's decode or decode_all
2. Craft a truncated BSON regex element lacking the required NUL terminator
3. Submit the malformed BSON to the vulnerable decode path while the C accelerator is loaded
4. Observe process crash and denial of service

How to detect it

Review application and system logs for unexpected Python process terminations or segmentation faults occurring shortly after BSON decode calls; correlate with any custom code paths that invoke decode or decode_all on untrusted input.

What your security team should do

• Immediately evaluate whether the C extension is required and disable it where possible
• Inventory all applications using the MongoDB Python driver and prioritize upgrades once a fixed release is published
• Add runtime checks or input sanitization around any custom BSON decoding paths
• Monitor upstream driver releases and apply patches within standard change windows