Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

pymongo Python driver can crash on bad data

published 27 days ago
Summary

The pymongo library that lets Python talk to MongoDB can stop working if it receives specially crafted data with a broken regular‑expression field. This may cause the program using the library to shut down. Update to the latest version of pymongo or avoid feeding it untrusted data.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
PyPI the mongodb python team pymongo >= 3.9.0, <= 4.18.2
Original advisory text
Duplicate Advisory: PYTHON-6110 Out-of-bounds read in BSON decoding via a malformed Regex element
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-98qm-wvgf-w4cf. This link is maintained to preserve external references.

## Original Description
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.3 High
Type
CWE-125Out-of-bounds Read
Timeline
Published8 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
GHSA-86gh-39m5-hhg6 · OSV
Track software like this
Free during beta