Search/CVE-2026-84963
● CVE — Medium

CVE-2026-84963

VendormongodbProductc driverDiscoveredSep 3, 2026UpdatedSep 22, 2026

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

CVSS v3.1
5.3 MEDIUM
EPSS
0.31%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 5, 2026 → Sep 25, 2026
▲ 0.12pp
0.19% → 0.31% over 2 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityLOW
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Connections
2 relationships
Timeline
disclosure → media coverage
Sep 3, 2026
Disclosure — published as a CVE record. · last revised by NVD Sep 22, 2026