CVE-Katalog
CVE-2026-93395
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document
- Schweregrad
- Medium · CVSS 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.40% · Oct 23, 2026
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | mongo-c-driver | sid | 2.5.7-1 | fixed |
| Debian | mongo-c-driver | forky | 2.5.6-1 | fixed |
| Debian | mongo-c-driver | trixie | 1.30.4-1+deb13u3 | vulnerable |
| Debian | mongo-c-driver | bookworm | 1.23.1-1+deb12u3 | vulnerable |
| Cpe | c_driver | Not reported | 2.3.1 | fixed |
| Ubuntu | mongo-c-driver | pro | 1.24.3-1 | vulnerable |
| Ubuntu | mongo-c-driver | pro | 1.24.4-1 | vulnerable |
| Ubuntu | mongo-c-driver | pro | 1.25.1-1 | vulnerable |
| Ubuntu | mongo-c-driver | pro | 1.25.2-1 | vulnerable |
| Ubuntu | mongo-c-driver | pro | 1.25.4-1 | vulnerable |
| Ubuntu | mongo-c-driver | pro | 1.26.0-1 | vulnerable |
| Ubuntu | mongo-c-driver | pro | 1.26.0-1.1ubuntu1 | vulnerable |
| Ubuntu | mongo-c-driver | pro | 1.26.0-1.1ubuntu2 | vulnerable |
| Ubuntu | mongo-c-driver | pro | 1.26.0-1.1ubuntu2+esm1 | vulnerable |
| Ubuntu | mongo-c-driver | 26.04 | 1.30.4-1ubuntu1 | vulnerable |
| Ubuntu | mongo-c-driver | 26.04 | 2.2.0-1 | vulnerable |
| Ubuntu | mongo-c-driver | 26.04 | 2.2.1-1 | vulnerable |
| Ubuntu | mongo-c-driver | 26.04 | 2.2.2-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | mongo-c-driver | source | sid | 2.4.0-1 | not yet assigned | Not reported | Not reported |
| Debian | mongo-c-driver | source | forky | 2.4.0-1 | not yet assigned | Not reported | Not reported |
| Debian | mongo-c-driver | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | mongo-c-driver | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Cpe | c_driver | cpe | Not reported | 2.3.1 | Not reported | NVD-CVE-2026-93395 | Not reported |
Notes
[trixie] mongo-c-driver: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libbson-1.0-0]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.23.1-1+deb12u3· amd64 · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
1.23.1-1+deb12u3· arm64 · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
- [libbson-dev]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.23.1-1+deb12u3· amd64 · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
1.23.1-1+deb12u3· arm64 · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
- [libbson-doc]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.23.1-1+deb12u3· all · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
1.23.1-1+deb12u3· all · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
- [libmongoc-1.0-0]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.23.1-1+deb12u3· amd64 · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
1.23.1-1+deb12u3· arm64 · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
- [libmongoc-dev]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.23.1-1+deb12u3· amd64 · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
1.23.1-1+deb12u3· arm64 · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
- [libmongoc-doc]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.23.1-1+deb12u3· all · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
1.23.1-1+deb12u3· all · bookwormBetroffen
nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12
[Debian 13 (Trixie)]
- [libbson-1.0-0t64]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.30.4-1+deb13u2· amd64 · trixieBetroffen
nvd · mongo-c-driver · debian · 13
1.30.4-1+deb13u2· arm64 · trixieBetroffen
nvd · mongo-c-driver · debian · 13
- [libbson-dev]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.30.4-1+deb13u2· amd64 · trixieBetroffen
nvd · mongo-c-driver · debian · 13
1.30.4-1+deb13u2· arm64 · trixieBetroffen
nvd · mongo-c-driver · debian · 13
- [libbson-doc]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.30.4-1+deb13u2· all · trixieBetroffen
nvd · mongo-c-driver · debian · 13
1.30.4-1+deb13u2· all · trixieBetroffen
nvd · mongo-c-driver · debian · 13
- [libmongoc-1.0-0t64]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.30.4-1+deb13u2· amd64 · trixieBetroffen
nvd · mongo-c-driver · debian · 13
1.30.4-1+deb13u2· arm64 · trixieBetroffen
nvd · mongo-c-driver · debian · 13
- [libmongoc-dev]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.30.4-1+deb13u2· amd64 · trixieBetroffen
nvd · mongo-c-driver · debian · 13
1.30.4-1+deb13u2· arm64 · trixieBetroffen
nvd · mongo-c-driver · debian · 13
- [libmongoc-doc]Betroffen
Quellpaket: [mongo-c-driver]
Details (2)
1.30.4-1+deb13u2· all · trixieBetroffen
nvd · mongo-c-driver · debian · 13
1.30.4-1+deb13u2· all · trixieBetroffen
nvd · mongo-c-driver · debian · 13
Beobachtet:
Referenzen
- [https://nvd.nist.gov/vuln/detail/CVE-2026-93395]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-93395]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-93395]
- [https://security-tracker.debian.org/tracker/CVE-2026-93395]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3453.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]