CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
An attacker supplying malformed BSON to the MongoDB Python Driver's decode API can cause a denial of service via out-of-bounds read when the C extension is loaded.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106435?
CVE-2026-106435 is a medium-severity denial of service vulnerability in MongoDB Python Driver, published on 8 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
Weakness: CWE-125
Which versions are affected by CVE-2026-106435?
2 open source packages ship an affected version, including pymongo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pymongo PyPI | From 3.9.0 | 4.18.3 |
pymongo PyPI | From 3.9.0 | 4.18.3 |
Products include Mongodb Python Driver.
How do I fix CVE-2026-106435?
Upgrade pymongo to 4.18.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-106435 being exploited?
There is no known exploitation of CVE-2026-106435 in the wild and no public exploit code.
Other vulnerabilities in MongoDB Python Driver
Sources
Also known as AZL-107129, DEBIAN-CVE-2026-106435, ECHO-0def-1f54-e1ea, GHSA-98qm-wvgf-w4cf, MINI-8jph-pcjp-cf84, UBUNTU-CVE-2026-106435.