CVE-2026-106438

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-27

Assigner: MongoDB, Inc.

Description

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-27

Generated

2026-11-08

AI Q&A

2026-10-08

EPSS Evaluated

2026-11-07

NVD

CVE-2026-106438

EUVD

EUVD-2026-95154

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	c_driver	From 1.4.0 (inc) to 1.30.13 (exc)
mongodb	c_driver	From 2.0.0 (inc) to 2.5.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-682	The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

Executive Summary

This vulnerability involves an incorrect calculation in Decimal128 string parsing in the MongoDB C Driver. It accepts over-precision inputs with leading zeros instead of rejecting them, leading to a stored or used numeric value different from the input text. This can occur through Extended JSON parsing or when providing decimal strings to embedding applications.

Detection Guidance

This vulnerability involves incorrect parsing of Decimal128 strings in the MongoDB C Driver. Detection requires checking if your application uses the MongoDB C Driver and if it processes decimal strings with leading zeros. Review application logs for parsing errors or unexpected numeric values. No specific commands are provided in the context.

Impact Analysis

An attacker who can provide a decimal string to an application using the MongoDB C Driver could cause incorrect numeric values to be stored or processed. This may lead to financial errors, data corruption, or incorrect calculations in applications relying on precise decimal values.

Compliance Impact

This vulnerability could impact compliance by causing incorrect data storage or processing, potentially violating integrity requirements in GDPR or HIPAA. If applications handle regulated data with this flaw, it may lead to non-compliance due to data inaccuracies or integrity breaches.

Mitigation Strategies

Immediately update the MongoDB C Driver to the latest patched version. If updating is not possible, restrict input validation to reject decimal strings with leading zeros. Review stored data for incorrect numeric values caused by this issue.

Hi! I’m here to help you understand CVE-2026-106438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...