CVE-2026-84963: Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use the MongoDB C Driver's BSON library to parse JSON and accept JSON input from unauthenticated parties are exposed if attacker-controlled unusually large text values can reach that parser.
What does an attacker need to exploit it?
An attacker needs only the ability to supply JSON processed by the affected application. The issue is network-reachable, requires no privileges or user interaction, and is triggered through unusually large string values.
How can an application tell whether it has been affected?
Look for successful JSON-to-BSON parsing of unusually large text fields where the resulting BSON field is shorter than the submitted value or is absent entirely. The parser may report success and return no error despite the mismatch.
What is the practical impact?
The primary impact is integrity: an application may retain data that differs from the input it received, potentially causing unintended data alteration. The provided information does not indicate confidentiality disclosure or availability impact.