Description

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-03T16:18:25.120Z",
  "pubdate": "2026-09-03T16:18:25.120Z",
  "executiveSummary": "A critical vulnerability exists in the MongoDB C Driver's BSON library due to incorrect numeric conversion during JSON parsing. This flaw allows for silent data integrity issues where input values are truncated or omitted without triggering parsing errors. The vulnerability impacts systems utilizing the affected C Driver to process external JSON input. Because the parser returns a success signal despite the underlying data corruption, downstream applications may operate on invalid data, leading to unintended state changes or logic errors. The attack requires no authentication, as an unauthenticated actor can supply crafted JSON payloads to trigger the conversion error. The primary risk is the loss of data integrity, which could be leveraged to manipulate application business logic or bypass security controls that rely on accurate numerical inputs from BSON fields.\nThe vulnerability represents a failure in error handling and type validation within the serialization layer, where excessive numeric values are improperly managed. Given the library's role in critical database interactions, the failure to report parsing errors poses a significant risk to application consistency and data reliability. Remediation requires an update to the driver to ensure proper validation and robust error reporting during the numeric conversion process.",
  "technicalDetails": "The vulnerability originates within the JSON parsing component of the MongoDB C Driver's BSON library. It is triggered by an incorrect numeric conversion process when the parser encounters a numeric value in a JSON string that exceeds expected limits. Rather than raising an exception or returning a failure code upon encountering these values, the component silently handles the overflow or invalid input by either shortening the numeric representation or omitting the specific field from the resulting BSON object.\nFrom an exploitation perspective, the attack flow begins with an unauthenticated threat actor identifying an endpoint that processes JSON data via the vulnerable MongoDB C Driver. The attacker supplies a specially crafted JSON payload containing a numerically large or malformed value designed to trigger the identified conversion fault. Because the parser returns a status of 'success' to the parent application, the application proceeds to process the data as if it were valid. This results in the database or internal data structures storing incorrect, truncated, or missing information.\nThe root cause lies in the insufficient boundary checking and error state propagation during the conversion of numeric data types within the BSON library. The vulnerable component fails to validate if the parsed number can be accurately represented in the target data format. Consequently, the application logic assumes the data is both present and accurate, allowing the corrupted data to propagate through the system's execution path. This post-exploitation impact allows for silent data corruption, which can lead to severe security implications if the affected fields are utilized in critical operations, such as authorization checks, financial calculations, or access control lists.\nThe attack does not require elevated privileges, as it targets the input parsing stage accessible by any entity capable of sending data to the application. The network exposure is broad, encompassing any distributed system or microservice architecture that relies on the MongoDB C Driver to ingest and transform JSON data into BSON for database storage. As the parsing operation reports success, standard monitoring tools that only inspect return codes will fail to detect that the application has accepted malformed or corrupt data, making this a stealthy integrity-based attack vector."
}