MongoDB C# Driver CVE-2026-114644

Exploitation requires that the host application actually deserializes attacker-influenced BSON or JSON input using the MongoDB C

driver, and that the supplied content carries BSON symbol (BsonSymbol) values - the specific value type whose interning is unbounded. The weakness is that deserialized symbols are interned and retained for the entire process lifetime with no cap, so attacker-supplied symbols accumulate across requests. Limiting factors: the application must expose a deserialization path to untrusted data (not inherent to merely having the driver installed), only availability is affected (no confidentiality or integrity impact), no MongoDB server component is affected, and the CVSS marks attack complexity as high (AC:H); the detailed reason for AC:H is not described in the available sources. Fixed in driver v3.13.0, where BsonSymbol values are no longer interned.

Signals point to a real but bounded availability risk rather than a top-tier emergency. The vendor (MongoDB CNA) CVSS 4.0 vector is AV:N/AC:H/AT:N/PR:N/UI:N with VA:H and VC:N/VI:N - i.e. a network-reachable, unauthenticated denial of service affecting availability only, scored 8.2. The AC:H metric indicates the attack is not entirely trivial/attacker-controlled, which tempers the otherwise high base score; per the supplied evidence the precise trigger difficulty is not elaborated, so AC:H should be read as severity, not as a described race or timing condition. The vuln.today decision label is 'this_week', consistent with a serious-but-not-drop-everything DoS. Exploitation status: no public exploit identified at time of analysis (the two references are a vendor release tag and a Jira ticket, neither a working exploit). No EPSS score was provided in the input, so exploitation probability cannot be quantified - this is missing data, not a low score. CVE is NOT listed in CISA KEV. Net: a genuine unauthenticated remote DoS in a widely used .NET library, worth prioritized patching to v3.13.0, but confidentiality and integrity are explicitly unaffected and no server component is impacted, so it is not a critical compromise-class issue.

A .NET application uses the MongoDB C

driver to deserialize BSON or JSON content that originates from an untrusted remote party. The attacker repeatedly submits content containing many distinct BSON symbol values; because each symbol is interned and retained for the lifetime of the process, memory grows without bound until the host application is exhausted and service is denied. No public exploit was identified, and the CVSS marks attack complexity as high (AC:H).