Skip to content
Fencer Vulns
medium 6.5

CVE-2026-118581 json

NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

published 2026-10-28 12 d ago modified 2026-11-05 4 d ago also EUVD-2026-112257

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to influence those bytes through the victim application, and no user interaction is needed. The result is unintended modification of the command actually executed, which can alter the data read or written under the application's credentials.

Patch / fix

  • MongoDB Java Driver 5.14.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-118581 updated cvss 6.5

org.mongodb/bson: MongoDB Java Driver: Unintended command modification via improper BSON document length validation

  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat build of Apache Camel 4 for Quarkus 3 bson 5.6.4.redhat-00002 Red Hat build of Debezium 3 bson 5.6.4.redhat-00002 Red Hat build of Quarkus bson 5.6.4.redhat-00002
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Fuse 7 bson 5.6.4.redhat-00002
    affected: workaround, no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 d ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • MongoDB Java Driver

Classification

Weakness
  • CWE-943 Improper Neutralization of Special Elements in Data Query Logic

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.