CVE-2026-84969
Last modified
CVE-2026-84969 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mongodb | C Driver | >= 1.30.0, < 1.30.9 |
| Mongodb | C Driver | >= 2.0.0, < 2.5.2 |
References
- https://jira.mongodb.org/browse/CDRIVER-6410Vendor Advisory, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-84969?
How severe is CVE-2026-84969?
How do I fix CVE-2026-84969?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-84963An incorrect numeric conversion in the JSON parsing componen…5.3
- CVE-2026-84964A double free in the OpenSSL-based TLS certificate revocatio…7.5
- CVE-2026-84965An integer wraparound in an allocation size calculation in t…5.5
- CVE-2026-84966An incorrect numeric type conversion in the BSON document bu…5.5
- CVE-2026-84967A component of the MongoDB extension for Visual Studio Code …4.3
- CVE-2026-84968An out-of-bounds read in the BSON decoding component of the …5.3
- CVE-2026-8497Improper certificate validation in the Devolutions Server co…7.4
- CVE-2026-84970A numeric truncation weakness exists in the JSON parsing com…5.8
- CVE-2026-84971Improper handling of an unexpected value size in the decrypt…6.5
- CVE-2026-84975PJSIP is a free and open source multimedia communication lib…7.4
- CVE-2026-84989ntopng is a web-based network traffic monitoring application…7.1
- CVE-2026-8499The Helpfulcrowd Product Reviews plugin for WordPress is vul…5.3
Are you affected by CVE-2026-84969?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST