Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118581— NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

Quick assessment

Affected
MongoDB Java Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB Java 驱动中的 BSON 编码组件未验证外部提供的原始文档所声明的长度是否与其实际给定的字节范围一致，就在将该范围复制到发往数据库的命令之前。因此，任何将不可信的原始字节包装成此类文档并将其作为命令一部分的应用程序，都可能发出结构不一致的消息，导致数据库将攻击者提供的尾部内容误解析为周围命令的附加字段。除通过受害应用程序影响这些字节的能力外，无需对驱动程序或数据库进行任何身份验证，也无需用户交互。其结果是实际执行的命令被意外篡改，从而在应用程序凭据下修改了读取或写入的数据。

CVSS 6.5 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
MongoDB Java Driver 5.8.0< 5.14.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118581

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
Source: CVE Program / CVE List V5
Vulnerability Description
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to influence those bytes through the victim application, and no user interaction is needed. The result is unintended modification of the command actually executed, which can alter the data read or written under the application's credentials.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB Java Driver 5.8.0 ~ 5.14.0 -

II. Public POCs for CVE-2026-118581

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118581

请登录查看更多情报信息。

Vendor Pages for CVE-2026-118581 (1)

Same Patch Batch · MongoDB · 2026-10-28 · 3 CVEs total

CVE-2026-118510 8.8 HIGH Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
CVE-2026-116641 6.8 MEDIUM The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

IV. Related Vulnerabilities

Same product: Java Driver
Same vendor: MongoDB
Same weakness: CWE-943