{"schema":"threatline.record/2","record":{"id":"CVE-2026-96749","aliases":["GHSA-v4x9-3549-crwv","PYSEC-2026-4296"],"summary":"PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding","details":"An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process.","categories":["Databases"],"product":"pymongo","vendor":"MongoDB","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v4x9-3549-crwv","source_modified_at":"2026-10-05T23:47:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pymongo"},"range":"< 4.18.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96749","source_modified_at":"2026-09-26T03:55:41.712Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Python Driver","vendor":"MongoDB","versions":[{"lessThan":"4.18.2","status":"affected","version":"1.9.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v4x9-3549-crwv","source_modified_at":"2026-10-15T14:56:20.520518785Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"pymongo","ecosystem":"PyPI","purl":"pkg:pypi/pymongo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2"}]}],"versions":["0.1.1pre","0.1.2pre","0.10","0.10.1","0.10.2","0.10.3","0.11","0.11.1","0.11.2","0.11.3","0.12","0.13","0.14","0.14.1","0.14.2","0.15","0.15.1","0.15.2","0.16","0.1pre","0.2pre","0.3.1pre","0.3pre","0.4pre","0.5.1pre","0.5.2pre","0.5.3pre","0.5pre","0.6","0.7","0.7.1","0.7.2","0.8","0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","1.0","1.1","1.1.1","1.1.2","1.10","1.10.1","1.11","1.2"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-v4x9-3549-crwv","source_modified_at":"2026-10-05T23:47:11Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"pymongo"},"version":"4.18.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96749","source_modified_at":"2026-09-26T03:55:41.712Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Python Driver","ecosystem":null},"version":"4.18.2","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-v4x9-3549-crwv","source_modified_at":"2026-10-15T14:56:20.520518785Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"pymongo","ecosystem":"PyPI","purl":"pkg:pypi/pymongo"},"version":"4.18.2"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00132,"percentile":0.02531,"score_date":"2026-10-23"},"published_at":"2026-09-24T18:18:13.077Z","modified_at":"2026-10-15T14:56:20.520518785Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-v4x9-3549-crwv","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T23:47:11Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-96749","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-26T03:55:41.712Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-v4x9-3549-crwv","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T14:56:20.520518785Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96749","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96749","source":"GitHub Advisory Database"},{"url":"https://github.com/mongodb/mongo-python-driver/pull/3066","source":"GitHub Advisory Database"},{"url":"https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7","source":"GitHub Advisory Database"},{"url":"https://github.com/mongodb/mongo-python-driver/commit/6ab44be0e97c9d1d5a23725c4978fb25f3249485","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"},{"source":"CVE List","url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"},{"url":"https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-v4x9-3549-crwv","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-09-25T00:00:00+00:00"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:56:20.520518785Z","content_hash":"89062461b7136579894b7462594bf1024c8c2fe2fcc49c344c03c6e9c471a8d3"}}