IT SBIT Services
Schneeberger
DEEN
CVE tracker

MongoDB C# Driver: Memory exhaustion in BSON deserialization via symbol interning

CVE-2026-114644High 8.2

← All vulnerabilities

Summary

The MongoDB C# Driver (MongoDB.Bson NuGet package) keeps symbol values from deserialized BSON and JSON in a static table that is never cleared. An unauthenticated remote party who can get a .NET application to deserialize crafted untrusted content with many distinct symbol names can make the process's memory grow without limit, which denies service. The vulnerability affects only host applications that deserialize untrusted input with the driver; the MongoDB server is not affected and there is no confidentiality or integrity impact.

Affected

  • MongoDB.Bson (MongoDB C# Driver) from 2.0.0 to before 3.13.0
  • Applications that deserialize untrusted BSON or JSON, including those using BsonDocument, RawBsonDocument or [BsonExtraElements] dictionaries

Fixed in

  • Upgrade MongoDB.Bson to version 3.13.0 or later
  • Review code that creates BsonSymbol values directly and use BsonSymbol.Create or the implicit string conversion instead, as BsonSymbolTable is now obsolete
  • Test the upgrade before rollout, as 3.13.0 contains breaking behavior changes

Workaround

Unknown. No vendor workaround is documented. If an upgrade is delayed:

  • Restrict which callers can submit BSON or JSON for deserialization and reject untrusted input at the edge
  • Enforce request size limits on endpoints that accept BSON or JSON
  • Set container memory limits and monitor memory growth of affected .NET services

Exploitation

  • No confirmed in-the-wild exploitation is known. No CISA KEV entry was found in the research; verify before closing.
  • A public proof of concept is listed by the Italian CSIRT (ACN) and in the vendor's security advisory.
  • Exhausting memory is reported to require a very large number of distinct symbols, which limits practical exploitation.

Our recommendation

  • Inventory .NET applications that use MongoDB.Bson and identify those below 3.13.0.
  • Prioritise internet-facing applications that deserialize untrusted BSON or JSON.
  • Upgrade to MongoDB.Bson 3.13.0 or later together with the other security fixes in that release, and test first.
  • Until the upgrade, apply the workarounds above and monitor memory usage of affected services.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:50.

Original description (NVD)

The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is affected.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed