Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-114644 Details

Description

The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5.9 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-x24v-h3xm-qf9x	CISA-ADP
https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0	[email protected]
https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-x24v-h3xm-qf9x	[email protected]
https://jira.mongodb.org/browse/CSHARP-6162	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-770	Allocation of Resources Without Limits or Throttling	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

3 change records found show changes

Date	Action	Recorded By
Nov 2, 2026	CVE Modified	CISA-ADP
Oct 22, 2026	CVE Modified	[email protected]
Oct 22, 2026	New CVE Received	[email protected]