{"metadata": {"vulnerability": "cve-2026-96749", "count": 46, "kinds": {"milestone": 13, "sighting": 4, "kev": 0, "other": 29}}, "data": [{"timestamp": "2026-09-23T15:45:51.412Z", "date_only": false, "value": "2026-09-23T15:45:51.412Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-96749", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": true, "value": "2026-09-24", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1234", "record": "CERTFR-2026-AVI-1234", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-24T18:18:13.077Z", "date_only": false, "value": "2026-09-24T18:18:13.077Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-96749", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-24T19:12:06.439Z", "date_only": false, "value": "2026-09-24T19:12:06.439Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mongodb", "record": "cve-2026-96749", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-24T19:17:00Z", "date_only": false, "value": "2026-09-24T19:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-96749", "record": "UBUNTU-CVE-2026-96749", "field": "published"}, {"timestamp": "2026-09-24T19:17:20Z", "date_only": false, "value": "2026-09-24T19:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V4X9-3549-CRWV", "record": "GHSA-V4X9-3549-CRWV", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-24T19:17:20.963Z", "date_only": false, "value": "2026-09-24T19:17:20.963", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96749", "record": "FKIE_CVE-2026-96749", "field": "published"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-96749", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96749", "record": "FKIE_CVE-2026-96749", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-25T02:09:18Z", "date_only": false, "value": "2026-09-25T02:09:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6", "record": "CVE-2026-96749", "field": "creation_timestamp", "uuid": "725f50fa-1cc3-454e-8f3d-941626dc48ab", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mongodb-6"}, {"timestamp": "2026-09-25T05:16:54.641Z", "date_only": false, "value": "2026-09-25T05:16:54.641021Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwczdjty352c", "record": "CVE-2026-96749", "field": "creation_timestamp", "uuid": "1eff9b4d-af25-49f2-974d-5e7b3432e674", "content": "\ud83d\udfe0 CVE-2026-96749 - High (8.4)\n\nAn integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundle...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-96749/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwczdjty352c"}, {"timestamp": "2026-09-26T03:55:41.712Z", "date_only": false, "value": "2026-09-26T03:55:41.712Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-96749", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-26T03:55:41.712Z", "date_only": false, "value": "2026-09-26T03:55:41.712Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-96749", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-26T04:17:52.260Z", "date_only": false, "value": "2026-09-26T04:17:52.260", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-96749", "record": "FKIE_CVE-2026-96749", "field": "lastModified"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1234", "record": "CERTFR-2026-AVI-1234", "field": "last_revision_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1234", "record": "CERTFR-2026-AVI-1234", "field": "initial_release_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1234", "record": "CERTFR-2026-AVI-1234", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-28T08:45:12.366Z", "date_only": false, "value": "2026-09-28T08:45:12.366575Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweseq6t2f", "record": "CVE-2026-96749", "field": "creation_timestamp", "uuid": "130825c4-3726-4c40-a55d-ab09f1893b81", "content": "\ud83d\udd17 CVE : CVE-2026-96745, CVE-2026-96746, CVE-2026-96747, CVE-2026-96748, CVE-2026-96749", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweseq6t2f"}, {"timestamp": "2026-09-29T16:18:54Z", "date_only": false, "value": "2026-09-29T16:18:54Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2026:4398-1", "record": "SUSE-SU-2026:4398-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-29T16:18:54Z", "date_only": false, "value": "2026-09-29T16:18:54Z", "kind": "other", "label": "Date", "source": "csaf_suse \u00b7 SUSE-SU-2026:4398-1", "record": "SUSE-SU-2026:4398-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-09-29T16:18:54Z", "date_only": false, "value": "2026-09-29T16:18:54Z", "kind": "other", "label": "Document generated", "source": "csaf_suse \u00b7 SUSE-SU-2026:4398-1", "record": "SUSE-SU-2026:4398-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-29T16:18:54Z", "date_only": false, "value": "2026-09-29T16:18:54Z", "kind": "milestone", "label": "Published", "source": "csaf_suse \u00b7 SUSE-SU-2026:4398-1", "record": "SUSE-SU-2026:4398-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-29T16:36:21Z", "date_only": false, "value": "2026-09-29T16:36:21Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:22003-1", "record": "OPENSUSE-SU-2026:22003-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-29T16:36:21Z", "date_only": false, "value": "2026-09-29T16:36:21Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:22003-1", "record": "OPENSUSE-SU-2026:22003-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-09-29T16:36:21Z", "date_only": false, "value": "2026-09-29T16:36:21Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:22003-1", "record": "OPENSUSE-SU-2026:22003-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-29T16:36:21Z", "date_only": false, "value": "2026-09-29T16:36:21Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:22003-1", "record": "OPENSUSE-SU-2026:22003-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11935-1", "record": "OPENSUSE-SU-2026:11935-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11935-1", "record": "OPENSUSE-SU-2026:11935-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11935-1", "record": "OPENSUSE-SU-2026:11935-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11935-1", "record": "OPENSUSE-SU-2026:11935-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-30T11:16:55Z", "date_only": false, "value": "2026-09-30T11:16:55Z", "kind": "other", "label": "Advisory revision", "source": "csaf_suse \u00b7 SUSE-SU-2026:4398-1", "record": "SUSE-SU-2026:4398-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-30T11:16:55Z", "date_only": false, "value": "2026-09-30T11:16:55Z", "kind": "other", "label": "Updated", "source": "csaf_suse \u00b7 SUSE-SU-2026:4398-1", "record": "SUSE-SU-2026:4398-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-01T10:22:59Z", "date_only": false, "value": "2026-10-01T10:22:59Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11935-1", "record": "OPENSUSE-SU-2026:11935-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-01T10:22:59Z", "date_only": false, "value": "2026-10-01T10:22:59Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:11935-1", "record": "OPENSUSE-SU-2026:11935-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-01T16:39:46Z", "date_only": false, "value": "2026-10-01T16:39:46Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:22003-1", "record": "OPENSUSE-SU-2026:22003-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-01T16:39:46Z", "date_only": false, "value": "2026-10-01T16:39:46Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:22003-1", "record": "OPENSUSE-SU-2026:22003-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-05T23:47:10Z", "date_only": false, "value": "2026-10-05T23:47:10Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V4X9-3549-CRWV", "record": "GHSA-V4X9-3549-CRWV", "field": "published"}, {"timestamp": "2026-10-05T23:47:11Z", "date_only": false, "value": "2026-10-05T23:47:11Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V4X9-3549-CRWV", "record": "GHSA-V4X9-3549-CRWV", "field": "modified"}, {"timestamp": "2026-10-06T05:01:25Z", "date_only": false, "value": "2026-10-06T05:01:25Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MONGO-ORCHESTRATION-CVE-2026-96749", "record": "BREW-MONGO-ORCHESTRATION-CVE-2026-96749", "field": "published"}, {"timestamp": "2026-10-06T08:30:31Z", "date_only": false, "value": "2026-10-06T08:30:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/bc410e99534ffbee2708ecb962d9c3f6", "record": "cve-2026-96749", "field": "creation_timestamp", "uuid": "2386dc6d-bde0-47b7-9305-39ca66a7eba2", "content": "# CVE-2026-96749: CVE-2026-96749: Heap Out-of-Bounds Write in MongoDB PyMongo BSON Encoder\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-96749\n\n## Summary\nAn integer overflow vulnerability exists in PyMongo's bundled C extension (bson/buffer.c) when serializing abnormally large documents. Due to compiler optimizations utilizing standard C Undefined Behavior rules, memory overflow validation checks are completely removed during compilation, enabling an attacker to trigger a heap-based out-of-bounds write.\n\n## TL;DR\nCompiler optimization of undefined signed integer overflow checks in PyMongo's native BSON encoder leads to heap-based buffer overflow when serializing objects larger than 2GiB.\n\n## Technical Details\n\n- **CWE ID**: CWE-190 (Integer Overflow or Wraparound), CWE-122 (Heap-based Buffer Overflow)\n- **Attack Vector**: Local (Elevated to Remote if exposing serialization endpoints)\n- **CVSS v3.1 Score**: 8.4 (High Severity)\n- **CVSS Vector**: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n- **EPSS Score**: 0.00132 (0.13% probability of exploitation)\n- **Exploit Status**: None (No public exploits or wild-exploitation documented)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running on 64-bit architectures using PyMongo with native C extensions enabled.\n- **PyMongo**: >= 1.9.0, < 4.18.2 (Fixed in: `4.18.2`)\n\n## Mitigation\n\n- Upgrade PyMongo to version 4.18.2 or higher.\n- Disable PyMongo native C extensions by setting the environment variable PYTHON_BSON_EXTENSIONS=0.\n- Implement application-level input size limits to reject payloads approaching MongoDB's 16MB maximum document size.\n\n**Remediation Steps:**\n1. Verify the installed PyMongo package version using 'pip show pymongo'.\n2. Execute 'pip install --upgrade pymongo>=4.18.2' to apply the official security patch.\n3. If upgrading is not possible, append 'export PYTHON_BSON_EXTENSIONS=0' to the environment profiles of your runtime systems.\n4. Introduce validation logic at input gateways to intercept and drop JSON/BSON structures that exceed defined size thresholds.\n\n## References\n\n- [GitHub Security Advisory GHSA-v4x9-3549-crwv](https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv)\n- [NVD CVE-2026-96749 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-96749)\n- [PyMongo Bug Merge Commit](https://github.com/mongodb/mongo-python-driver/commit/6ab44be0e97c9d1d5a23725c4978fb25f3249485)\n- [PyMongo Fix Commit](https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7)\n- [PyMongo Pull Request 3066](https://github.com/mongodb/mongo-python-driver/pull/3066)\n- [PyMongo Release 4.18.2](https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2)\n- [PyMongo 4.18.2 Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst)\n- [CVE-2026-96749 Record](https://www.cve.org/CVERecord?id=CVE-2026-96749)\n- [Wiz Vulnerability Analysis Data](https://www.wiz.io/vulnerability-database/cve/cve-2026-96749)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-96749) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/bc410e99534ffbee2708ecb962d9c3f6"}, {"timestamp": "2026-10-06T19:06:28Z", "date_only": false, "value": "2026-10-06T19:06:28Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-PROWLER-CVE-2026-96749", "record": "BREW-PROWLER-CVE-2026-96749", "field": "published"}, {"timestamp": "2026-10-15T10:22:46.249Z", "date_only": false, "value": "2026-10-15T10:22:46.249312Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4296", "record": "PYSEC-2026-4296", "field": "published"}, {"timestamp": "2026-10-15T14:38:08.667Z", "date_only": false, "value": "2026-10-15T14:38:08.667294Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4296", "record": "PYSEC-2026-4296", "field": "modified"}, {"timestamp": "2026-10-16T09:29:28Z", "date_only": false, "value": "2026-10-16T09:29:28Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MONGO-ORCHESTRATION-CVE-2026-96749", "record": "BREW-MONGO-ORCHESTRATION-CVE-2026-96749", "field": "modified"}, {"timestamp": "2026-10-16T09:56:39Z", "date_only": false, "value": "2026-10-16T09:56:39Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-PROWLER-CVE-2026-96749", "record": "BREW-PROWLER-CVE-2026-96749", "field": "modified"}, {"timestamp": "2026-10-17T09:58:14Z", "date_only": false, "value": "2026-10-17T09:58:14Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-96749", "record": "UBUNTU-CVE-2026-96749", "field": "modified"}]}