{"uuid": "351a7853-b509-4672-b0df-1ce7ce80562c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-v4x9-3549-crwv", "type": "seen", "source": "https://gist.github.com/alon710/bc410e99534ffbee2708ecb962d9c3f6", "content": "# CVE-2026-96749: CVE-2026-96749: Heap Out-of-Bounds Write in MongoDB PyMongo BSON Encoder\n\n> **CVSS Score:** 8.4\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-96749\n\n## Summary\nAn integer overflow vulnerability exists in PyMongo's bundled C extension (bson/buffer.c) when serializing abnormally large documents. Due to compiler optimizations utilizing standard C Undefined Behavior rules, memory overflow validation checks are completely removed during compilation, enabling an attacker to trigger a heap-based out-of-bounds write.\n\n## TL;DR\nCompiler optimization of undefined signed integer overflow checks in PyMongo's native BSON encoder leads to heap-based buffer overflow when serializing objects larger than 2GiB.\n\n## Technical Details\n\n- **CWE ID**: CWE-190 (Integer Overflow or Wraparound), CWE-122 (Heap-based Buffer Overflow)\n- **Attack Vector**: Local (Elevated to Remote if exposing serialization endpoints)\n- **CVSS v3.1 Score**: 8.4 (High Severity)\n- **CVSS Vector**: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n- **EPSS Score**: 0.00132 (0.13% probability of exploitation)\n- **Exploit Status**: None (No public exploits or wild-exploitation documented)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running on 64-bit architectures using PyMongo with native C extensions enabled.\n- **PyMongo**: >= 1.9.0, < 4.18.2 (Fixed in: `4.18.2`)\n\n## Mitigation\n\n- Upgrade PyMongo to version 4.18.2 or higher.\n- Disable PyMongo native C extensions by setting the environment variable PYTHON_BSON_EXTENSIONS=0.\n- Implement application-level input size limits to reject payloads approaching MongoDB's 16MB maximum document size.\n\n**Remediation Steps:**\n1. Verify the installed PyMongo package version using 'pip show pymongo'.\n2. Execute 'pip install --upgrade pymongo>=4.18.2' to apply the official security patch.\n3. If upgrading is not possible, append 'export PYTHON_BSON_EXTENSIONS=0' to the environment profiles of your runtime systems.\n4. Introduce validation logic at input gateways to intercept and drop JSON/BSON structures that exceed defined size thresholds.\n\n## References\n\n- [GitHub Security Advisory GHSA-v4x9-3549-crwv](https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv)\n- [NVD CVE-2026-96749 Analysis](https://nvd.nist.gov/vuln/detail/CVE-2026-96749)\n- [PyMongo Bug Merge Commit](https://github.com/mongodb/mongo-python-driver/commit/6ab44be0e97c9d1d5a23725c4978fb25f3249485)\n- [PyMongo Fix Commit](https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7)\n- [PyMongo Pull Request 3066](https://github.com/mongodb/mongo-python-driver/pull/3066)\n- [PyMongo Release 4.18.2](https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2)\n- [PyMongo 4.18.2 Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst)\n- [CVE-2026-96749 Record](https://www.cve.org/CVERecord?id=CVE-2026-96749)\n- [Wiz Vulnerability Analysis Data](https://www.wiz.io/vulnerability-database/cve/cve-2026-96749)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-96749) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T08:30:31.000000Z"}