Vulnerability in MongoDB C Driver

[ Description ]Official description

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3830

  MongoDB Treiber: Multiple vulnerabilities Translated from German

  CVE-2026-106435CVE-2026-106434CVE-2026-106429+10 more CVEs

[ References ]References

• jira.mongodb.org/browse/CDRIVER-6419