Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-84963 Details

Description

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://jira.mongodb.org/browse/CDRIVER-6407	[email protected]	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-681	Incorrect Conversion between Numeric Types	[email protected]

Affected Products

Product	Versions
mongodb c driver	>= 1.10.0, < 1.30.9 >= 2.0.0, < 2.5.2
CPE cpe:2.3:a:mongodb:c_driver::::::mongodb::* Remediation No remediation found in references.

Change History

3 change records found show changes

Date	Action	Recorded By
Sep 22, 2026	Initial Analysis	[email protected]
Sep 3, 2026	New CVE Received	[email protected]
Sep 3, 2026	CVE Modified	CISA-ADP