EUVD-2026-70505
GHSA-j94p-2ppx-483m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N reflects network-delivered attacker-controlled JSON; AC:H captures the requirement for very large input; C:L and I:L for OOB read and silent truncation; A:H for process crash.
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.
AnalysisAI
Numeric truncation in the MongoDB C++ Driver's BSON library JSON parsing interface allows an attacker who controls text fed to that interface to read process memory beyond the input buffer, cause silent acceptance of a truncated document fragment as complete, or terminate the host process. Affected systems are any C++ applications embedding the driver that parse externally-controlled JSON; MongoDB server connectivity, credentials, and non-default configuration are explicitly not required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The consuming application must pass externally-controlled text to the MongoDB C++ Driver's BSON library JSON parsing interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H) is broadly credible: AT:P (attack requirements present) correctly captures the need for a very large input document to trigger the integer boundary condition, VA:H correctly identifies process termination as the primary impact, and VC:L/VI:L capture the secondary OOB-read and partial-parse risks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade the MongoDB C++ Driver to the patched version referenced in the upstream Jira ticket CXX-3547 (https://jira.mongodb.org/browse/CXX-3547); no specific fixed version number is confirmed from the available data, so consumers should check the Jira entry and the driver's official release changelog for the confirmed patched build before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-681 – Incorrect Conversion between Numeric Types
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today