PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

[ Description ]Official description

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process.

[ Fixes ]Fixes and patches

• pymongo 4.18.2Fixed version · GitHub Advisories · pip package pymongo: upgrade to 4.18.2 or later (affected < 4.18.2)
• Security bulletin: MongoDB GHSA-frjf-h5jg-4v46Vendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-qx36-8mw2-4r3xVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-vp6j-j7w5-5xjjVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB 3579Vendor patch or bulletin · CERT-FR · github.com/mongodb/laravel-mongodb/pull/3579, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB v1.49.12Vendor patch or bulletin · CERT-FR · github.com/mongodb-js/compass/releases/tag/v1.49.12, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-cmvj-vxvq-rh2cVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-v4x9-3549-crwvVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3, cited by CERT-FR CERTFR-2026-AVI-1234

[ Advisories ]Government CERT advisories

• CERT-FR28 Sep 2026CERTFR-2026-AVI-1234

  Multiple vulnerabilities in MongoDB Translated from French

  Multiple vulnerabilities have been discovered in MongoDB. They allow an attacker to cause a breach of data integrity, a security policy bypass and a security problem not specified by the vendor.

  CVE-2026-96745CVE-2026-96748CVE-2026-96747+2 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3583

  MongoDB Treiber (Python Driver, PHP Driver, C Driver, Compass and Laravel): Multiple vulnerabilities Translated from German

  CVE-2026-96744CVE-2026-96745CVE-2026-96750+4 more CVEs

[ Packages ]Affected open-source packages

• pymongo pipAffected < 4.18.2 · fixed in 4.18.2 · GHSA-v4x9-3549-crwv

[ References ]References

• github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
• github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
• github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv