CVE-2026-106435 in Python Driver
Summary
by MITRE • 10/09/2026
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in the MongoDB Python Driver stems from a buffer over-read condition within its binary accelerator component, specifically triggered during the decoding of malformed Binary Object Notation data. This security flaw manifests when an application utilizes the documented decode or decode_all APIs to process BSON payloads that contain truncated regular-expression elements lacking the required trailing null byte. The root cause lies in the C extension implementation used for performance optimization, which fails to perform adequate bounds checking before accessing memory associated with these malformed string structures. Consequently, if a malicious actor can supply such crafted BSON data to be decoded by an application using this driver, it results in out-of-bounds memory access. This improper input validation leads directly to the termination of the application process due to a segmentation fault or similar critical error caused by reading invalid memory addresses.
From an operational perspective, while the vulnerability does not allow for arbitrary code execution or direct data exfiltration through this specific path, it poses a significant risk regarding availability and service continuity. An attacker who can inject malformed BSON into any system that consumes such data using the affected driver version could induce a denial of service by crashing the consuming application process. It is crucial to note that this vulnerability is isolated to the binary accelerator used in specific decoding operations and does not affect the normal database wire-protocol path, meaning standard direct interactions with MongoDB servers are generally unaffected unless they explicitly invoke these vulnerable decode functions on untrusted input. The impact is therefore limited to scenarios where user-controlled or externally supplied BSON data is processed through the specified APIs while the C extension is loaded.
This issue aligns with Common Weakness Enumeration category CWE-125, which describes out-of-bounds read vulnerabilities resulting from insufficient validation of array indices or buffer lengths before memory access. In terms of adversarial tactics, this vulnerability relates to ATT&CK technique T1499, specifically endpoint denial of service via application crashes, although it is worth noting that the primary vector here is input processing rather than resource exhaustion in the traditional sense. The lack of proper boundary checks on string termination characters represents a classic memory safety error common in C-based extensions within Python libraries.
To mitigate this risk, organizations should immediately upgrade to patched versions of the MongoDB Python Driver where the buffer bounds checking logic has been corrected for regular-expression element decoding. Until an update is applied, defensive measures include implementing strict input validation at the application layer before passing any BSON data to the driver's decode functions. Additionally, running applications in sandboxed environments with restricted privileges can limit the blast radius of a potential crash, although it does not prevent the denial of service itself. Monitoring for unexpected process terminations associated with MongoDB client libraries may also aid in detecting exploitation attempts or accidental triggers of this flaw in production environments.