AZL-107129
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107129.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-107129
- Upstream
- CVE-2026-106435
- Published
- 2026-10-08T21:17:51Z
- Modified
- 2026-10-12T05:33:09Z
- Summary
- CVE-2026-106435 affecting package python-pymongo 4.2.0-9
- Details
-
The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
- References