CVE-2026-114644
Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.
| CWE | CWE-770 |
| Vendor | mongodb |
| Product | c# driver |
| Ecosystems | |
| Industries | Technology |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb c# driver
Be the first to know when new medium vulnerabilities affecting mongodb c# driver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
MongoDB / C# Driver
2.0.0 < 3.13.0