MongoDB up to 1.30.12/2.5.5 C Driver calculation

Summaryinfo

A vulnerability was found in MongoDB up to 1.30.12/2.5.5 and classified as problematic. This affects an unknown part of the component C Driver. Such manipulation leads to calculation. This vulnerability is listed as CVE-2026-106438. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in MongoDB up to 1.30.12/2.5.5. It has been rated as problematic. Affected by this issue is an unknown code of the component C Driver. The manipulation with an unknown input leads to a calculation vulnerability. Using CWE to declare the problem leads to CWE-682. The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. Impacted is integrity. CVE summarizes:

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

The advisory is available at jira.mongodb.org. This vulnerability is handled as CVE-2026-106438 since 10/06/2026. The exploitation is known to be easy. The attack may be launched remotely. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 366933 (Fedora 44 : mongo-c-driver (2026-4f2386f4ac)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.30.13 or 2.5.6 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (366933) and CERT Bund (WID-SEC-2026-3830). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source MongoDB

Productinfo

Type

• Database Software

Name

• MongoDB

Version

• 1.30.0
• 1.30.1
• 1.30.2
• 1.30.3
• 1.30.4
• 1.30.5
• 1.30.6
• 1.30.7
• 1.30.8
• 1.30.9
• 1.30.10
• 1.30.11
• 1.30.12
• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion