1. Home
  2. CVE Database
  3. CVE-2026-84970
MEDIUM · 6.2

CVE-2026-84970

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public ...

Vulnerability Description

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

CVSS Score

6.2

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
HIGH

Affected Products

VendorProductVersions
MongodbC\+\+ Driver>= 3.2.0, < 4.5.2

Related Weaknesses (CWE)

CWE-681

References

FAQ

What is CVE-2026-84970?

CVE-2026-84970 is a vulnerability with a CVSS score of 6.2 (MEDIUM). A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public ...

How severe is CVE-2026-84970?

CVE-2026-84970 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-84970?

Check the references section above for vendor advisories and patch information. Affected products include: Mongodb C\+\+ Driver.