CVE-2026-106438

The record

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

Affected packages

Related vulnerabilities

• CVE-2026-115786 A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an… CWE-682
• CVE-2026-53670 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-53671 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-53706 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-54754 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-682
• CVE-2026-76043 Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote… CWE-682
• CVE-2026-71479 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset… CWE-682
• CVE-2026-20763 Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within… CWE-682