{"id":"ghsa-ghsa-98qm-wvgf-w4cf","seq":1708792,"kind":"advisory","title":"MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element","url":"https://github.com/advisories/GHSA-98qm-wvgf-w4cf","permalink":"https://vulnpulse.app/items/ghsa-ghsa-98qm-wvgf-w4cf","summary":"影響: pip:pymongo >= 3.9.0, <= 4.18.2 → 4.18.3\nThe C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decode_all accept mmap and array buffers, which carry no NUL sentinel; the read can cross into unmapped memory and kill the process with an uncatchable SIGSEGV. Any application decoding untrusted BSON from such buffers is affected — impact is availabili…","severity":"high","techs":["python","mongodb"],"cves":["CVE-2026-106435"],"tags":["GHSA-98qm-wvgf-w4cf","pymongo"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:36:35.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}