EUVD-2026-108322Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted serialized BSON to exposed endpoint
-
ExploitDeserialize into mapped primitive collection type
-
ExecutionUninitialized residual thread bytes surfaced as values
-
ImpactDisclose limited data from other requests or principals
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires that the consuming application deserialize attacker-supplied serialized data into certain primitive collection types using the MongoDB C Driver (2.26.0 up to but not including 3.13.0); this mapping behavior is the specific trigger named in the description. The disclosed bytes are residual data left over from unrelated content processed earlier on the SAME execution thread, so successful leakage further requires that exploitable residue from another request or principal be present on that thread at parse time - the AT:P (attack requirement) in the CVSS 4.0 vector reflects this dependency, and it limits reliable, targeted extraction. No authentication or special application privileges are required (PR:N), and no user interaction is needed, but the impact is bounded to a limited amount of information (VC:L) rather than full memory disclosure. |
| Impact | This is a limited information-disclosure flaw (CWE-908, use of uninitialized resource) in the BSON deserialization layer of the MongoDB C Driver. The only severity signal provided is a CVSS 4.0 vector (score 6.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N): network-reachable, no privileges or user interaction, but carrying AT:P - a specific attack requirement must hold - and only Low confidentiality impact to a subsequent system (SC:L), with no integrity or availability impact. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact breakdown were supplied; the only priority signal is the vuln.today Decision label 'this_month', which aligns with a moderate, patch-in-routine-cycle issue rather than an emergency. No public exploit or PoC reference appears in the input (references are only the vendor release tag and a Jira ticket), so this is no public exploit identified at time of analysis. The AT:P requirement is material: exploitation depends on exploitable residual data from other requests happening to sit on the same execution thread at parse time, which makes reliable, targeted extraction uncertain rather than a straightforward mass-exploitation primitive. Net assessment: a genuine but bounded confidentiality issue worth patching on the vendor's stated 'this_month' cadence, not a drop-everything priority, and the absence of KEV/EPSS/PoC data is consistent with that. |
| Exploit ScenarioDerived | An unauthenticated client sends specially crafted serialized data to a .NET application that uses the MongoDB C Driver to deserialize BSON into certain primitive collection types. Because the deserializer can surface uninitialized residual bytes, the attacker receives, embedded in otherwise legitimate values, a small amount of leftover data from unrelated requests or principals processed earlier on the same thread. No public exploit code is identified in the available sources, and reliable extraction depends on exploitable residue being present on the shared thread. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Limited information disclosure in MongoDB C
Driver versions 2.26.0 through before 3.13.0 allows unauthenticated remote attackers to surface residual bytes from earlier same-thread processing when an application deserializes crafted BSON into certain primitive collection types. The leak is bounded to a limited amount of data belonging to other requests or principals and depends on exploitable residue being present on the thread at parse time; no public exploit was identified at time of analysis, and the vendor released 3.13.0 as the fix. The vuln.today priority label is this_month.
RemediationAI
Vendor-released patch: 3.13.0. Upgrade MongoDB C
Driver to 3.13.0 or later; the release is available at https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 and the associated JIRA item is https://jira.mongodb.org/browse/CSHARP-6170. The 3.13.0 release notes state that it addresses a number of CVEs and includes stricter validation of malformed raw BSON and other deserialization fixes, so review the documented behavior changes before upgrading. The supplied references do not document a specific workaround, so the vendor fix is the upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-908 (use of uninitialized resource) in the BSON deserialization component of the MongoDB C
Driver. Crafted serialized input processed by an application that maps certain primitive collection types can cause bytes left over from unrelated content processed earlier on the same execution thread to be returned as legitimate values, exposing limited information from other requests or principals. The CVSS 4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N, and the independent assessment is CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N; together these reflect a remote, unauthenticated path with an attack requirement (residue from unrelated prior processing on the same thread) and limited confidentiality impact rather than full memory disclosure. Affected driver versions per EUVD are 2.26.0 up to but not including 3.13.0. The vendor's 3.13.0 release notes describe multiple BSON security fixes and stricter handling of invalid raw BSON and related inputs; the CVE references the MongoDB JIRA item CSHARP-6170.
Know when MongoDB gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H because leakage depends on exploitable residual data on the shared thread; S:C and C:L as only a limited amount of another principal's data is disclosed.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
1DescriptionCVE.org
A memory-handling weakness in the BSON deserialization component of the MongoDB C
Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo
The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regul
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's
The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary
MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of e
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. Rated critical severity (CVSS 9.8
Memory corruption in the MongoDB BI Connector ODBC Driver (fixed in v1.4.9) occurs when an oversized catalog, schema, or
Exploit-DB