MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element

影響: pip:pymongo >= 3.9.0, <= 4.18.2 → 4.18.3

The C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decode_all accept mmap and array buffers, which carry no NUL sentinel; the read can cross into unmapped memory and kill the process with an uncatchable SIGSEGV. Any application decoding untrusted BSON from such buffers is affected — impact is availabili…

Read on GitHub Advisory Database

On 10/28/2026, 12:36 AM, GitHub Advisory Database published "MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element" (type: Advisory). Severity is "High" (high). Related technologies: Python, MongoDB. CVE: CVE-2026-106435.