medium4.0
CVE-2026-106438
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of reje…
Impact
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongodb | C Driver | from 1.4.0 before 1.30.13 from 2.0.0 before 2.5.6 |