Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Versions of pymongo before 4.18.2 are affected by a heap out-of-bounds write in the BSON document encoder of the bundled native extension. The flaw is a signed 32-bit size overflow on very large caller-supplied data, and the overflow guard relies on undefined C behavior. An unprivileged party who can supply a very large value that the application encodes may trigger a write outside an allocated buffer in the application process, depending on how the extension was built. Upgrade to pymongo 4.18.2 or later; the source lists no other workaround.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 4.0 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CNA (mongodb) |
- CISA KEV Not listed.
- EPSS 0.0019, the 8th percentile, on 8 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:08 UTC First seen by agentprime
- 31 Oct 2026, 14:08 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-v4x9-3549-crwv
- OSV: GHSA-v4x9-3549-crwv
- github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv
- nvd.nist.gov/vuln/detail/CVE-2026-96749
- github.com/mongodb/mongo-python-driver/pull/3066
- github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7
- github.com/mongodb/mongo-python-driver/commit/6ab44be0e97c9d1d5a23725c4978fb25f3249485
- github.com/mongodb/mongo-python-driver
- github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
- github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
- www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732