MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element

影響: pip:pymongo >= 3.9.0, <= 4.18.2 → 4.18.3

The C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decode_all accept mmap and array buffers, which carry no NUL sentinel; the read can cross into unmapped memory and kill the process with an uncatchable SIGSEGV. Any application decoding untrusted BSON from such buffers is affected — impact is availabili…

在 GitHub Advisory Database 阅读

2026/10/28 00:36，GitHub Advisory Database 发布了“MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python、MongoDB。CVE：CVE-2026-106435。