Vulnerability Description
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application. No authentication or special privileges within the application are required.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
- https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-f8xm-c88
- https://jira.mongodb.org/browse/CSHARP-6170
- https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-f8xm-c88
FAQ
What is CVE-2026-114651?
CVE-2026-114651 is a vulnerability with a CVSS score of 4.0 (MEDIUM). A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized in...
How severe is CVE-2026-114651?
CVE-2026-114651 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114651?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.