CVE-2026-84970

Katalog CVE

CVSS 5.8 · Medium EPSS 0,12%

Kerentanan Incorrect Conversion between Numeric Types pada mongodb c++ driver. Skor CVSS 3.1 5.8 (Medium) menurut NVD.

Deskripsi (NVD)

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

Rincian

Terbit di NVD

3 September 2026

Terakhir diubah

10 September 2026

Status NVD

Analyzed

CVSS 3.1

5.8 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-681: Incorrect Conversion between Numeric Types

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/CXX-3547 advisory vendor · issue tracking