Zero Radar
← feed
HighVulnerabilityCVE-2026-106435updated 27 Oct 2026, 15:37 UTC

PyMongo BSON decoder can crash Python process on crafted input

A specially crafted data blob can make a Python app that reads MongoDB data crash suddenly. The crash stops the program but does not expose or steal any data.

Fixed in PyMongo 4.18.3Official source
SeverityHighCVSS 8.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesPyMongo 4.18.3 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Crafted BSON sentTruncated Regex element in untrusted data
  2. 2App decodes databson.decode on mmap or array buffer
  3. 3Out-of-bounds readstrlen scans past buffer end
  4. 4Process crashesSIGSEGV kills the process
  5. ResultApplication process crashes (denial of service)

What happened

The C extension of PyMongo's BSON decoder reads a Regex element's pattern using strlen before checking remaining buffer length, allowing out-of-bounds reads past the end of mmap or array buffers and causing SIGSEGV.

Why it is dangerous: Any application decoding untrusted BSON from mmap or array buffers can be crashed by an attacker, causing denial of service; there is no confidentiality impact stated.

Are you affected?

You are affected if your application uses PyMongo 3.9.0 through 4.18.2 with the C extension loaded and decodes untrusted BSON via bson.decode or bson.decode_all from mmap or array buffers.

Package / productAffected versionsFixed in
pymongo · pip>= 3.9.0, <= 4.18.24.18.3

What to do

  1. Update PyMongo to 4.18.3 or later (pip install --upgrade pymongo)
  2. Until updated, decode untrusted BSON only from bytes or bytearray buffers
  3. If using mmap input, copy it first, e.g. bytes(mm[:size])

Timeline

  1. 27 Oct 2026, 15:36 UTC
    Publicly disclosed
  2. 27 Oct 2026, 15:36 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 15:37 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-106435 · GHSA-98qm-wvgf-w4cf
CVSS
8.2 / 10
EPSS
0.1% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 15:36 UTC
On Zero Radar
27 Oct 2026, 15:37 UTC (1 min after disclosure)
Last change
27 Oct 2026, 15:37 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PyMongo BSON decoder can crash Python process on crafted input · Zero Radar