CVE-2026-114651

A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.

• CWE-908

• https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
• https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-f8xm-c88f-wq46
• https://jira.mongodb.org/browse/CSHARP-6170

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114646A data-validation flaw exists in the BSON handling and binar…6.5
• CVE-2026-114647The MongoDB C# Driver does not reject replacement documents …4.3
• CVE-2026-114648The MongoDB C# Driver does not neutralize dot and dollar cha…7.6
• CVE-2026-114649The MongoDB C# Driver compares TLS client certificates by is…6.8
• CVE-2026-11465A security flaw has been discovered in songquanpeng one-api …3.1
• CVE-2026-114650A flaw in the client-side encryption support of the MongoDB …5.9
• CVE-2026-114652A data-query-logic neutralization weakness in the update-sta…6.5
• CVE-2026-114653A client-side encryption schema construction component in th…6.5
• CVE-2026-114654A numeric-type conversion flaw in the BSON handling library …6.5
• CVE-2026-114655libmongocrypt builds requests to external key management ser…5.9
• CVE-2026-114656Traefik before 2.11.58 and 3.7.13 contains an authentication…7.5
• CVE-2026-114657Grav from 2.0.0 before 2.2.5 contains an information disclos…5.7