AIKIDO-2026-135360
mongodb.mongo-c-driver is vulnerable to Integer Overflow or Wraparound
59
Medium Risk
This Affects:
mongodb.mongo-c-driverTL;DR
libbson grows internal buffers with bson_next_power_of_two and unchecked size arithmetic during JSON parsing and array append. On 32-bit builds a sufficiently large input makes the size computation wrap to a smaller value, so the buffer is reallocated (and the old buffer freed) while a subsequent copy still writes through the stale, undersized pointer. Externally supplied JSON of sufficient size then crashes the process. The fix saturates the power-of-two growth at SIZE_MAX and adds checked add and multiply helpers before allocation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run a 32-bit build that parses externally influenced JSON input.
Background info
mongodb.mongo-c-driver is vulnerable to Integer Overflow or Wraparound in versions 1.10.0 - 1.30.8 and 2.0.0 - 2.5.1.
How to fix this
Upgrade the mongodb.mongo-c-driver library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.