CVE-2026-106438
Fixed in a distro release EPSS <1%CVSS 4.0
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.
Products: mongodb c_driver
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | mongo-c-driver | no fix |
| Debian 13 | mongo-c-driver | no fix |
| Debian 14 | mongo-c-driver | 2.5.6-1 |
| Ubuntu 26.04 LTS | mongo-c-driver | no fix |
| Ubuntu 26.10 | mongo-c-driver | no fix |
| Ubuntu Pro 20.04 LTS | mongo-c-driver | no fix |
| Ubuntu Pro 22.04 LTS | mongo-c-driver | no fix |
| Ubuntu Pro 24.04 LTS | mongo-c-driver | no fix |