CVE-2026-106435

Name	CVE-2026-106435
Description	The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150462

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pymongo (PTS)	bookworm	3.11.0-1+deb12u1	vulnerable
	trixie	4.10.1-6	vulnerable
	forky	4.18.1-1	vulnerable
	sid	4.18.2-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pymongo	source	(unstable)	(unfixed)			1150462

Notes

[trixie] - pymongo <no-dsa> (Minor issue)
https://jira.mongodb.org/browse/PYTHON-6110
Fixed by: https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4 (4.18.3)