MongoDB C Driver up to 1.30.8/2.5.1 JSON Parsing integer overflow

Summaryinfo

A vulnerability identified as critical has been detected in MongoDB C Driver up to 1.30.8/2.5.1. Affected is an unknown function of the component JSON Parsing. Performing a manipulation results in integer overflow. This vulnerability was named CVE-2026-84965. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in MongoDB C Driver up to 1.30.8/2.5.1. It has been classified as critical. This affects some unknown functionality of the component JSON Parsing. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on availability. The summary by CVE is:

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

It is possible to read the advisory at jira.mongodb.org. This vulnerability is uniquely identified as CVE-2026-84965 since 09/02/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 342827 (Linux Distros Unpatched Vulnerability : CVE-2026-84965), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.30.9 or 2.5.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (342827) and CERT Bund (WID-SEC-2026-3209). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Fedora Linux
• Open Source MongoDB

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• C Driver

Version

• 1.30.0
• 1.30.1
• 1.30.2
• 1.30.3
• 1.30.4
• 1.30.5
• 1.30.6
• 1.30.7
• 1.30.8
• 2.5.0
• 2.5.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion