Vulnerability PYSEC-2026-1826
Medium Risk
MEDIUM RISK
CVSS Score: 4.7
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
3 months ago
July 07, 2026 at 11:45 AM UTC
PyMongo Out-of-bounds Read in the bson module
0.1pre - 4.6.2
0.1pre - 4.6.2
Summary
PyMongo Out-of-bounds Read in the bson module
Details
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
8 hours ago
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
0.1pre - 4.18.1 GHSA-v4x9-3549-crwv
0.1pre - 4.18.1 GHSA-v4x9-3549-crwv
Medium Risk
8 hours ago
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
3.5.0 - 4.18.1 GHSA-vp6j-j7w5-5xjj
3.5.0 - 4.18.1 GHSA-vp6j-j7w5-5xjj
Medium Risk
8 hours ago
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
3.9.0 - 4.18.1 GHSA-qx36-8mw2-4r3x
3.9.0 - 4.18.1 GHSA-qx36-8mw2-4r3x
Medium Risk
8 hours ago
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
0.1pre - 4.18.0 GHSA-8fvv-fgr5-f8ch
0.1pre - 4.18.0 GHSA-8fvv-fgr5-f8ch
Medium Risk
2 years ago
PyMongo Out-of-bounds Read in the bson module
0.1pre - 4.6.2 GHSA-m87m-mmvp-v9qm
0.1pre - 4.6.2 GHSA-m87m-mmvp-v9qm
Impacted packages
Timeline
Published
3 months ago
July 07, 2026 at 11:45 AM UTC
Fixed (4.6.3)
2 years ago
March 28, 2024 at 01:22 AM UTC
Last Modified
3 months ago
July 07, 2026 at 05:47 PM UTC