CVE-2026-106437

Name	CVE-2026-106437
Description	The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mongo-c-driver (PTS)	bookworm	1.23.1-1+deb12u3	vulnerable
	trixie	1.30.4-1+deb13u3	vulnerable
	forky	2.5.5-1	vulnerable
	sid	2.5.6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mongo-c-driver	source	(unstable)	2.5.6-1

Notes

[trixie] - mongo-c-driver <no-dsa> (Minor issue)
https://jira.mongodb.org/browse/CDRIVER-6423
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/6c593a59a9dce87e42298b85779ca02a9357dd74 (2.5.6)
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/b7f1f5742351741c068020196fd88f196551aad2 (1.30.13)