CVE-2026-118581 in Java Driver
Summary
by MITRE • 10/28/2026
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to influence those bytes through the victim application, and no user interaction is needed. The result is unintended modification of the command actually executed, which can alter the data read or written under the application's credentials.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability described resides within the BSON encoding component of the MongoDB Java Driver, representing a critical failure in input validation that leads to structural inconsistency in database commands. The core technical flaw is rooted in the driver's handling of externally supplied raw documents. Specifically, when an application wraps untrusted raw bytes into a document structure for use in a database command, the driver fails to verify whether the self-declared length field within the BSON header accurately matches the actual extent of the byte range provided by the caller. This missing validation step allows for a discrepancy between what the metadata claims about the data size and the actual binary content being processed. Consequently, when this malformed document is serialized into an outgoing database command, the driver copies bytes beyond the declared boundary without checking if they belong to the current structure or are extraneous trailing content.
This lack of verification results in the emission of a structurally inconsistent message that violates the BSON specification's integrity requirements. Because MongoDB relies on these length fields to parse field boundaries and determine where one document ends and another begins, the presence of unvalidated trailing bytes causes the database server to misinterpret the command structure. The attacker-supplied content, which was intended as raw data or payload within a specific field, is instead parsed by the database engine as additional fields belonging to the surrounding command context. This effectively allows an injection-like scenario where arbitrary data influences the interpretation of the command's syntax and semantics, bypassing normal structural constraints that would otherwise isolate user input from control structures.
The operational impact of this vulnerability is severe due to its potential for unintended modification of executed commands without requiring authentication or direct access to the database server. An attacker who can influence the bytes passed into the vulnerable application component does not need credentials for either the Java Driver interface or the MongoDB instance itself. Furthermore, no user interaction is required beyond the initial injection point within the victim application's logic. By manipulating these raw bytes, an adversary can alter the data read from or written to the database under the application’s elevated privileges. This could lead to unauthorized data disclosure, integrity violations where critical records are modified or deleted, and potentially privilege escalation if the altered command triggers administrative functions that were not intended to be executed by the specific user context.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to correctly validate input before processing it in a way that could alter its execution path or structure. It also relates closely to CWE-74 Injection: Improper Neutralization of Special Elements used in an Output Mode Used in a Context (Injection), specifically within the context of command construction and serialization protocols. In terms of attack vectors, this behavior is consistent with ATT&CK technique T1190 Exploit Public-Facing Application, as it leverages flaws in how external-facing applications handle data input to compromise backend systems. The lack of authentication requirements places it firmly in the realm of remote code execution or data manipulation via untrusted inputs, highlighting a significant risk for any application relying on this driver version with user-controlled BSON structures.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary mitigation is to upgrade the MongoDB Java Driver to a patched version that enforces strict length validation during the encoding process. Developers should ensure that all updates are applied promptly, as unpatched versions remain vulnerable to this specific byte-range manipulation. In addition to software updates, application-level defenses should be implemented by avoiding the direct use of raw BSON bytes for user-supplied data whenever possible. Instead, applications should utilize high-level API methods that handle serialization and validation internally with stricter checks. If low-level access is necessary, developers must implement explicit length verification logic before passing any byte arrays to the driver's encoding components. Regular security audits focusing on input handling in database interaction layers are also recommended to identify similar patterns of improper validation across other data structures or drivers used within the application ecosystem.