CVE-2026-96749

Name	CVE-2026-96749
Description	An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1148967

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pymongo (PTS)	bookworm	3.11.0-1+deb12u1	vulnerable
	trixie	4.10.1-6	vulnerable
	forky, sid	4.18.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pymongo	source	(unstable)	4.18.2-1			1148967

Notes

[trixie] - pymongo <no-dsa> (Minor issue)
[bookworm] - pymongo <postponed> (Minor issue)
https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv