MongoDB Java Driver CVE-2026-118581

The vulnerable path is reached only when the application constructs a MongoDB command from a raw BSON document (e.g., wrapping externally supplied/untrusted bytes as a raw document) and sends it as part of a command; the driver fails to check that the document's self-declared length matches the extent of the provided byte range before copying it. No authentication to the driver or database and no user interaction are required beyond the attacker's ability to influence those bytes through the application. The key limiting factor is this non-default usage pattern: applications that build commands from normal typed/validated documents rather than untrusted raw bytes are not exposed, which materially narrows real-world attack surface despite PR:N.

This is a medium-severity (CVSS 4.0 base 6.9, MongoDB-reported) NoSQL command-injection flaw (CWE-943) in the BSON encoding path of the MongoDB Java Driver. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) indicates network reach, low complexity, no authentication to the driver/database and no user interaction, with low confidentiality and low integrity impact and no availability impact - consistent with the description's 'unintended modification of the command actually executed, altering data read or written.' The vuln.today priority is 'this_month' rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit were supplied; the only reference is the MongoDB 5.14.0 release notes. The practical caveat the raw CVSS does not capture: exploitation is gated on an application-side coding pattern - the victim app must wrap untrusted raw bytes in a raw BSON document and submit it as part of a command - so despite PR:N at the driver level, real-world exposure is narrower than a generic network-unauthenticated flaw. Net: a legitimate issue to patch on a normal cycle, not an emergency, with real risk concentrated in applications that handle untrusted raw BSON.

An attacker supplies crafted raw bytes to an application that wraps them in a raw BSON document and submits it as part of a MongoDB command. Because the driver does not verify the document's self-declared length against the actual byte range before copying it, the database parses attacker-controlled trailing content as additional command fields, altering the query executed under the application's credentials. No public exploit identified at time of analysis.