CVE-2026-114644 in C# Driver
Summary
by MITRE • 10/23/2026
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the MongoDB C# Driver’s BSON library represents a significant availability risk stemming from an uncontrolled resource consumption flaw during the deserialization of specific BSON value types. This issue arises because the underlying implementation retains data derived from untrusted content for the entire lifetime of the application process without imposing any limits on accumulation. Consequently, when an application utilizes this driver to deserialize external or untrusted input, it inadvertently allocates memory that is never released back to the operating system until the process terminates. This behavior creates a scenario where resource usage scales linearly with the volume and frequency of deserialized payloads, leading directly to unbounded memory growth within the host environment.
From an operational perspective, this flaw allows an unauthenticated remote attacker who has the ability to trigger the deserialization of malicious content to execute a denial-of-service attack against the target application. By repeatedly sending crafted BSON data that triggers this retention behavior, the attacker can exhaust the available system memory on the hosting server or container. Once the host’s memory resources are depleted, the application becomes unable to process legitimate requests, resulting in service unavailability for all users. It is critical to note that while the availability of the service is severely compromised, there is no impact on data confidentiality or integrity, as the vulnerability does not facilitate unauthorized access to sensitive information nor allow for arbitrary code execution or modification of stored data. Furthermore, this issue is isolated strictly to the client-side C# driver and does not affect any components within the MongoDB server itself.
In terms of industry classification standards, this weakness aligns with CWE-400, which describes uncontrolled resource consumption, specifically manifesting as a memory leak or exhaustion scenario due to improper handling of input data structures. The attack vector corresponds to ATT&CK technique T1496, Resource Hijacking, where an adversary consumes resources such that legitimate processes are denied service. To mitigate this risk, developers should ensure they are using the latest patched version of the MongoDB C# Driver which addresses the deserialization logic for the affected BSON value types. Additionally, implementing strict input validation and size limits on incoming data before it reaches the deserializer can provide a defensive layer against such exploitation attempts. Monitoring application memory usage patterns during high-load periods may also help in detecting anomalous behavior indicative of this vulnerability being actively exploited.