CVE-2026-106435: MongoDB Python Driver Buffer Overflow

CVE-2026-106435 Overview

CVE-2026-106435 is an out-of-bounds read [CWE-125] in the MongoDB Python Driver's binary accelerator C extension. The driver reads past a buffer when decoding malformed Binary JSON (BSON) that contains a truncated regular-expression element without a trailing NUL byte. An actor who can submit crafted BSON to the decode or decode_all API can terminate the application process. The normal database wire-protocol path does not reach the vulnerable code, which limits exposure to applications that decode untrusted BSON directly.

Critical Impact
Attackers who can supply malformed BSON to the exposed decode APIs can crash the Python application process, resulting in denial of service on the affected host.

Affected Products

MongoDB Python Driver (pymongo) with the C extension (binary accelerator) loaded
Applications invoking bson.decode or bson.decode_all on untrusted BSON input
Services exposing BSON parsing endpoints outside the standard MongoDB wire protocol

Discovery Timeline

2026-10-08 - CVE-2026-106435 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-106435

Vulnerability Analysis

The MongoDB Python Driver ships an optional C extension that accelerates BSON decoding. When this accelerator processes a BSON document containing a regular-expression element, it expects two NUL-terminated C strings for the pattern and options. If the input is truncated and the terminating NUL byte is missing, the parser continues reading past the end of the supplied buffer. The resulting out-of-bounds read triggers a segmentation fault that terminates the host Python process. The flaw affects availability only; confidentiality and integrity are not impacted, and no code execution has been demonstrated.

Root Cause

The root cause is missing bounds validation in the C accelerator when parsing BSON regular-expression (0x0B) elements. The decoder relies on an in-buffer NUL terminator to delimit the pattern and options strings. It does not confirm that the terminator lies within the remaining buffer length before reading further bytes. See MongoDB Python Issue PYTHON-6110 for the vendor's technical write-up.

Attack Vector

Exploitation requires an attacker to deliver crafted BSON to an application that explicitly calls bson.decode or bson.decode_all. This commonly occurs in services that accept BSON uploads, inter-process BSON messaging, or caching layers that store serialized BSON. The driver's normal MongoDB wire-protocol communication does not expose the vulnerable path, so a stock client connecting to a trusted MongoDB server is not at risk. The outcome is process termination rather than memory disclosure or arbitrary code execution.

Detection Methods for CVE-2026-106435

Indicators of Compromise

Unexpected SIGSEGV crashes or abnormal process termination in Python services that call bson.decode or bson.decode_all
Core dumps referencing the pymongo or bson C extension (_cbson) during BSON parsing
Spikes in application restart events correlated with ingestion of externally sourced BSON payloads

Detection Strategies

Audit source code and dependency graphs for direct calls to bson.decode and bson.decode_all that process untrusted input
Inventory running services for installed pymongo versions and whether the C extension is loaded
Instrument fuzz testing against BSON-consuming endpoints to surface truncated regex elements before deployment

Monitoring Recommendations

Alert on repeated worker crashes in Python application frameworks that process BSON
Capture and triage core dumps from services parsing BSON for stack frames in the binary accelerator
Correlate process termination telemetry with inbound network payloads to identify malicious senders

How to Mitigate CVE-2026-106435

Immediate Actions Required

Upgrade the MongoDB Python Driver (pymongo) to the fixed release identified in MongoDB Python Issue PYTHON-6110
Restrict exposure of bson.decode and bson.decode_all to trusted input sources only
Validate BSON length prefixes and reject truncated documents before passing them to the driver

Patch Information

MongoDB tracks the fix under PYTHON-6110. Apply the vendor-released pymongo version that includes the bounds-check correction in the BSON regular-expression parser. Rebuild or reinstall the package so the updated C extension replaces the vulnerable binary accelerator.

Workarounds

Disable the C extension by setting the environment variable PYMONGO_NO_C=1 before launching the application to fall back to the pure-Python decoder
Wrap decode and decode_all calls in a sandboxed worker process so crashes do not take down the primary service
Enforce strict schema validation on BSON payloads at the application boundary

bash

# Configuration example: upgrade pymongo and disable the C accelerator as a temporary workaround
pip install --upgrade pymongo
export PYMONGO_NO_C=1