CVE-2026-106438: MongoDB C Driver Decimal Parsing Vulnerability

CVE-2026-106438 Overview

CVE-2026-106438 is an incorrect calculation vulnerability [CWE-682] in the MongoDB C Driver. The flaw resides in the Decimal128 string parsing logic. The parser accepts certain over-precision inputs that contain leading zeros instead of rejecting them as invalid. This behavior causes the parsed numeric value to differ from the supplied text. An actor who controls a decimal string passed to an embedding application, including through Extended JSON parsing, can cause the application to store or process an incorrect numeric value. The issue affects data integrity rather than confidentiality or availability.

Critical Impact
Attacker-supplied Decimal128 strings can be silently converted to numeric values that do not match the input, corrupting stored or computed data in applications that embed the MongoDB C Driver.

Affected Products

MongoDB C Driver (libmongoc / libbson) Decimal128 parsing component
Applications embedding the MongoDB C Driver that accept Decimal128 strings
Any pipeline that parses MongoDB Extended JSON through the affected driver

Discovery Timeline

2026-10-08 - CVE-2026-106438 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-106438

Vulnerability Analysis

The MongoDB C Driver provides a Decimal128 parser that converts textual decimal representations into the IEEE 754-2008 128-bit decimal floating-point format used by BSON. The parser is responsible for enforcing precision limits defined by the Decimal128 specification, which permits up to 34 significant digits.

The vulnerability stems from the parser's handling of over-precision strings that begin with leading zeros. Rather than rejecting these inputs as outside the allowed significant-digit range, the parser accepts them and produces a numeric result that does not round-trip against the original text. The resulting Decimal128 value diverges from the string the caller supplied.

The impact is a data integrity issue. Downstream consumers trust that a parsed Decimal128 reflects the original textual input, so silent value mutation can corrupt financial, scientific, or inventory calculations. The flaw is tracked under MongoDB Bug Report CDRIVER-6419.

Root Cause

The root cause is incorrect calculation [CWE-682] in the significant-digit accounting path of the Decimal128 string parser. Leading zeros are not properly discounted when the parser evaluates whether an input exceeds the permitted precision, which allows oversized inputs to pass validation and be coerced into a lossy numeric result.

Attack Vector

Exploitation requires an attacker to supply a crafted decimal string to an application that uses the MongoDB C Driver. The most common entry point is Extended JSON parsing, where a $numberDecimal field can carry attacker-controlled text. Any interface that forwards user input into Decimal128 parsing, including configuration loaders, ingest pipelines, and API handlers, exposes the flaw.

The vulnerability does not grant code execution or data disclosure. It allows an attacker to cause the application to persist or operate on a numeric value that differs from the apparent input, which can be abused to manipulate business logic that relies on exact decimal representation.

No public exploit code is available. Technical details are documented in MongoDB Bug Report CDRIVER-6419.

Detection Methods for CVE-2026-106438

Indicators of Compromise

Decimal128 values stored in BSON documents that do not match the original Extended JSON $numberDecimal strings in upstream logs
Application audit records showing numeric drift between submitted and persisted decimal fields
Repeated Extended JSON inputs containing unusually long sequences of leading zeros in $numberDecimal fields

Detection Strategies

Instrument Decimal128 parsing paths to compare the input string against the canonical string form of the resulting Decimal128 value and alert on mismatches
Review MongoDB C Driver version metadata across build pipelines to identify binaries that embed vulnerable libbson releases
Add schema validation at the application layer that rejects decimal inputs exceeding 34 significant digits before they reach the driver

Monitoring Recommendations

Monitor ingestion services for Extended JSON payloads containing abnormal decimal literals, particularly those with long leading-zero runs
Track database write operations where Decimal128 fields deviate from reference values provided by trusted sources
Correlate application-layer input logs with BSON storage snapshots to identify silent value mutations

How to Mitigate CVE-2026-106438

Immediate Actions Required

Inventory all applications and services that link against the MongoDB C Driver (libmongoc, libbson) and identify versions in use
Validate and canonicalize decimal strings at the application boundary before passing them to the driver
Reject Extended JSON $numberDecimal inputs that exceed 34 significant digits or contain excessive leading zeros

Patch Information

Refer to MongoDB Bug Report CDRIVER-6419 for the fix status and the driver release that corrects the Decimal128 parser. Upgrade to the patched MongoDB C Driver version once published by MongoDB, and rebuild any statically linked applications.

Workarounds

Pre-validate decimal input with an independent parser and compare against the driver's output before persisting values
Normalize decimal strings by stripping leading zeros prior to invoking Decimal128 parsing
Restrict Extended JSON ingestion to trusted sources until the embedding application is rebuilt against a patched driver

bash

# Configuration example: application-layer validation before Decimal128 parsing
# Reject inputs that exceed Decimal128 precision (34 significant digits)
# Example pseudocode for an ingestion handler

if [[ $(echo -n "$DECIMAL_INPUT" | sed 's/^-//; s/^0*//; s/\.//; s/[eE].*//' | wc -c) -gt 34 ]]; then
  echo "reject: decimal exceeds Decimal128 precision"
  exit 1
fi