Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114654— BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards

Quick assessment

Affected
MongoDB C# Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB C驱动中 BSON 处理库存在一个数值类型转换漏洞。该漏洞允许通过不可信的文本输入提供超出范围的二进制子类型值，从而绕过库对二进制元素完整性的检查。当此类值随后被编码时，会被缩小为更小的网络表示形式，导致生成的二进制元素错误地声明其类型或长度。任何能够向受影响应用程序提供待解析文本的未授权用户，均可诱使该应用程序生成并持久化格式错误的二进制数据；后续读取这些数据的程序要么因错误而拒绝处理，要么静默地将其解释为比已验证数据更短的内容。

CVSS 6.5 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
MongoDB C# Driver 2.0.0< 3.13.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114654

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
Source: CVE Program / CVE List V5
Vulnerability Description
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter than the data that was validated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
数值类型间的不正确转换
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB C# Driver 2.0.0 ~ 3.13.0 -

II. Public POCs for CVE-2026-114654

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114654

请登录查看更多情报信息。

Other References for CVE-2026-114654 (3)

Same Patch Batch · MongoDB · 2026-10-22 · 13 CVEs total

CVE-2026-114648 7.6 HIGH NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary ke
CVE-2026-114649 6.8 MEDIUM Authentication bypass via issuer-and-serial-only certificate equality in shared cluster ca
CVE-2026-114652 6.5 MEDIUM Update operator injection via single-element list rewriting in the update builder
CVE-2026-114646 6.5 MEDIUM NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
CVE-2026-114653 6.5 MEDIUM Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builde
CVE-2026-114655 5.9 MEDIUM KMS request injection via unsanitized key vault and provider values in libmongocrypt
CVE-2026-114650 5.9 MEDIUM Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
CVE-2026-114644 5.9 MEDIUM Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deseri
CVE-2026-114643 5.4 MEDIUM Duplicate geometry fields via unvalidated GeoJSON extra members
CVE-2026-114645 5.2 MEDIUM Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message
CVE-2026-114647 4.3 MEDIUM NoSQL operator injection via unvalidated replacement document in findOneAndReplace
CVE-2026-114651 4.0 MEDIUM Cross-document data leak via malformed BSON array parsing in reused thread buffer

IV. Related Vulnerabilities

Same product: C# Driver
Same vendor: MongoDB
Same weakness: CWE-681

V. Comments for CVE-2026-114654

No comments yet

Leave a comment