CVE-2026-106438
Description
A flaw was found in the MongoDB C Driver. This vulnerability allows an attacker to compromise data integrity by causing an application to store or process incorrect numeric values. Due to a calculation error during Decimal128 string parsing, the driver accepts certain over-precision numbers with leading zeros instead of rejecting them. An attacker who can supply decimal strings to an application, such as through Extended JavaScript Object Notation (JSON) parsing, can trigger this issue to produce numeric values different from the supplied text.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
This weakness will generally lead to undefined results and therefore crashes. In some implementations the program will halt if the weakness causes an overflow during a calculation.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
The results of the math are not as expected. This could cause issues where a value would not be properly calculated and provide an incorrect answer.
Confidentiality,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data
This weakness can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a product's implicit security policy.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
