CVE-2026-114646

The record

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the amount of data actually provided, and it copies the data onto the wire unchanged. An unauthenticated party who can supply binary content to such an application can thereby cause additional elements to be inserted into, or existing elements to be removed from, the database command the application issues, without needing any database credentials of their own. This can result in unauthorized modification of stored data and disclosure of data outside the intended scope of the application's request, bounded by the database privileges the application itself holds.

Affected packages

Related vulnerabilities

• CVE-2026-119600 tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows… CWE-130
• CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-115794 P-Net before 1.0.3 passes the application alarm callback a data length derived from the… CWE-130
• CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked… CWE-130
• CVE-2026-114597 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length… CWE-130
• CVE-2026-116013 OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability… CWE-130