CVE-2026-114646— NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
Quick assessment
Affected
MongoDB C# Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MongoDB C驱动程序在 BSON 处理及二进制序列化路径中存在数据验证缺陷。当应用程序根据外部提供的二进制数据构建原始（raw）或延迟（lazy）BSON 文档对象时，驱动程序未验证该数据内部声明的大小与实际提供的数据量是否一致，而是将数据原样写入网络传输。因此，任何能够向此类应用程序提供二进制内容的未认证攻击者，均可在无需任何数据库凭据的情况下，向应用程序发出的数据库命令中插入额外元素，或删除现有元素。这可能导致对已存储数据的未授权修改，以及超出应用程序请求预期范围的数据泄露，其影响范围受限于该应用程序自身
Possible ATT&CK Techniques 3 AI
T1068.001 T1078 · Valid Accounts T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114646
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
Source: CVE Program / CVE List V5
Vulnerability Description
A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the amount of data actually provided, and it copies the data onto the wire unchanged. An unauthenticated party who can supply binary content to such an application can thereby cause additional elements to be inserted into, or existing elements to be removed from, the database command the application issues, without needing any database credentials of their own. This can result in unauthorized modification of stored data and disclosure of data outside the intended scope of the application's request, bounded by the database privileges the application itself holds.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
长度参数不一致性处理不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-114646
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114646
请登录查看更多情报信息。
Other References for CVE-2026-114646 (3)
Same Patch Batch · MongoDB · 2026-10-22 · 13 CVEs total
| CVE-2026-114648 | 7.6 HIGH | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary ke |
| CVE-2026-114649 | 6.8 MEDIUM | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster ca |
| CVE-2026-114652 | 6.5 MEDIUM | Update operator injection via single-element list rewriting in the update builder |
| CVE-2026-114654 | 6.5 MEDIUM | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards |
| CVE-2026-114653 | 6.5 MEDIUM | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builde |
| CVE-2026-114655 | 5.9 MEDIUM | KMS request injection via unsanitized key vault and provider values in libmongocrypt |
| CVE-2026-114650 | 5.9 MEDIUM | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name |
| CVE-2026-114644 | 5.9 MEDIUM | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deseri |
| CVE-2026-114643 | 5.4 MEDIUM | Duplicate geometry fields via unvalidated GeoJSON extra members |
| CVE-2026-114645 | 5.2 MEDIUM | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message |
| CVE-2026-114647 | 4.3 MEDIUM | NoSQL operator injection via unvalidated replacement document in findOneAndReplace |
| CVE-2026-114651 | 4.0 MEDIUM | Cross-document data leak via malformed BSON array parsing in reused thread buffer |
IV. Related Vulnerabilities
Same product: C# Driver
-
CVE-2026-114654
BSON output corruption via out-of-range binary subtype bypas -
CVE-2026-114653
Silent client-side encryption bypass via unescaped field-nam -
CVE-2026-114652
Update operator injection via single-element list rewriting -
CVE-2026-114651
Cross-document data leak via malformed BSON array parsing in -
CVE-2026-114650
Plaintext exposure of encrypted fields via ANSI code-page co
Same vendor: MongoDB
-
CVE-2026-114655
KMS request injection via unsanitized key vault and provider -
CVE-2026-114654
BSON output corruption via out-of-range binary subtype bypas -
CVE-2026-114653
Silent client-side encryption bypass via unescaped field-nam -
CVE-2026-114652
Update operator injection via single-element list rewriting -
CVE-2026-114651
Cross-document data leak via malformed BSON array parsing in
Same weakness: CWE-130
-
CVE-2026-105960
HMS Networks PEAK-System PCAN Windows drivers Improper Handl -
CVE-2026-110912
DragonFly BSD 6.4.2堆栈越界读漏洞 -
CVE-2026-101962
Junos OS and Junos OS Evolved: An attacker sending a malform -
CVE-2026-92159
F´: TlmPacketizer copies oversized telemetry past configured -
CVE-2026-102054
Junos OS and Junos OS Evolved: Insufficient validation of VX
V. Comments for CVE-2026-114646
No comments yet