All vulnerabilities
CVE-2026-96749GHSA-v4x9-3549-crwvPYSEC-2026-4296

PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

MongoDB pymongopipDatabases
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.18.2Fixed versionGitHub
Published24 Sep 2026Updated 15 Oct 2026CVE List

What fixes it

  • 4.18.2pymongo, pipGitHub
  • 4.18.2Python DriverCVE List
  • 4.18.2pymongo, PyPIOSVpip install "pymongo>=4.18.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process.

Text from CVE List

Affected versions 53

  • pymongo, pip< 4.18.2GitHub
  • Python Driveraffected: 1.9.0 before 4.18.2CVE List
  • pymongo, PyPIfrom first release, fixed in 4.18.2OSV
  • pymongo, PyPI0.1.1preOSV
  • pymongo, PyPI0.1.2preOSV
  • pymongo, PyPI0.10OSV
  • pymongo, PyPI0.10.1OSV
  • pymongo, PyPI0.10.2OSV
  • pymongo, PyPI0.10.3OSV
  • pymongo, PyPI0.11OSV
  • pymongo, PyPI0.11.1OSV
  • pymongo, PyPI0.11.2OSV
  • pymongo, PyPI0.11.3OSV
  • pymongo, PyPI0.12OSV
  • pymongo, PyPI0.13OSV
  • pymongo, PyPI0.14OSV
  • pymongo, PyPI0.14.1OSV
  • pymongo, PyPI0.14.2OSV
  • pymongo, PyPI0.15OSV
  • pymongo, PyPI0.15.1OSV
  • pymongo, PyPI0.15.2OSV
  • pymongo, PyPI0.16OSV
  • pymongo, PyPI0.1preOSV
  • pymongo, PyPI0.2preOSV
  • pymongo, PyPI0.3.1preOSV
  • pymongo, PyPI0.3preOSV
  • pymongo, PyPI0.4preOSV
  • pymongo, PyPI0.5.1preOSV
  • pymongo, PyPI0.5.2preOSV
  • pymongo, PyPI0.5.3preOSV
  • pymongo, PyPI0.5preOSV
  • pymongo, PyPI0.6OSV
  • pymongo, PyPI0.7OSV
  • pymongo, PyPI0.7.1OSV
  • pymongo, PyPI0.7.2OSV
  • pymongo, PyPI0.8OSV
  • pymongo, PyPI0.8.1OSV
  • pymongo, PyPI0.9OSV
  • pymongo, PyPI0.9.1OSV
  • pymongo, PyPI0.9.2OSV
  • pymongo, PyPI0.9.3OSV
  • pymongo, PyPI0.9.4OSV
  • pymongo, PyPI0.9.5OSV
  • pymongo, PyPI0.9.6OSV
  • pymongo, PyPI0.9.7OSV
  • pymongo, PyPI1.0OSV
  • pymongo, PyPI1.1OSV
  • pymongo, PyPI1.1.1OSV
  • pymongo, PyPI1.1.2OSV
  • pymongo, PyPI1.10OSV
  • pymongo, PyPI1.10.1OSV
  • pymongo, PyPI1.11OSV
  • pymongo, PyPI1.2OSV

References 9