The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes
    malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who
    can supply BSON to the documented decode or decode_all API can cause the application process to terminate
    when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
    (CVE-2026-106435)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes     malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who     can supply BSON to the documented decode or decode_all API can cause the application process to terminate     when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.
    (CVE-2026-106435)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477601	SCA: security update for pymongo (GHSA-98qm-wvgf-w4cf)	Tenable Cloud Security	SCA Checks	Local	medium
477601	SCA: security update for pymongo (GHSA-98qm-wvgf-w4cf)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
366198	Linux Distros Unpatched Vulnerability : CVE-2026-106435	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-106435

medium

Tenable Plugins

medium

medium

medium