An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3155 advisory.

    A flaw was found in pymongo. An integer overflow exists in the bundled native extension for Binary JSON     (BSON) document encoding when processing an unusually large amount of data. An unprivileged attacker who     can submit oversized data to an application for encoding can trigger an arithmetic overflow, resulting in     a write outside the boundaries of an allocated memory buffer. This issue can lead to arbitrary code     execution within the application process or a denial of service (DoS) via an application crash.
    (CVE-2026-96749)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native
    extension may occur when a single document is built from an unusually large amount of caller-supplied
    data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is
    written in a form whose behavior is not defined by the C language standard. A party with no privileges who
    can place a very large value into data that an application encodes may, depending on how the native
    extension was built, cause a write outside the bounds of an allocated buffer inside the application's own
    process. (CVE-2026-96749)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22003-1 advisory.

    Changes in python-pymongo:

    - CVE-2026-96749: integer overflow in BSON document encoding allows an       unprivileged user to write outside the bounds of an allocated buffer       (bsc#1282845)
    - CVE-2026-96748: host injection in connection string leading to       database connection redirection due to improper connection string       parsing (bsc#1282827)
    - CVE-2026-96747: improper handling of key management endpoint values       ending in `.sock` allows users with write access to the encryption       key metadata to open connections to local sockets on the application       host (bsc#1282844)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4398-1 advisory.

    - CVE-2026-96747: improper handling of key management endpoint values ending in `.sock` allows users with     write access       to the encryption key metadata to open connections to local sockets on the application host     (bsc#1282844).
    - CVE-2026-96748: host injection in connection string leading to database connection redirection due to     improper       connection string parsing (bsc#1282827).
    - CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside     the bounds of       an allocated buffer (bsc#1282845).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native     extension may occur when a single document is built from an unusually large amount of caller-supplied     data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is     written in a form whose behavior is not defined by the C language standard. A party with no privileges who     can place a very large value into data that an application encodes may, depending on how the native     extension was built, cause a write outside the bounds of an allocated buffer inside the application's own     process. (CVE-2026-96749)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365255	Amazon Linux 2023 : python3-bson, python3-pymongo, python3-pymongo-gridfs (ALAS2023-2026-3155)	Nessus	Amazon Linux Local Security Checks	Local	high
473577	Echo: pymongo: security update to 4.18.2	Tenable Cloud Security	Echo Local Security Checks	Local	high
473577	Echo: pymongo: security update to 4.18.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
473508	Chainguard: multiple localstack packages: security update to 4.14.0-r29	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
473508	Chainguard: multiple localstack packages: security update to 4.14.0-r29	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
472954	SCA: security update for pymongo (GHSA-v4x9-3549-crwv)	Tenable Cloud Security	SCA Checks	Local	high
472954	SCA: security update for pymongo (GHSA-v4x9-3549-crwv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
362567	openSUSE 16 Security Update : python-pymongo (openSUSE-SU-2026:22003-1)	Nessus	SuSE Local Security Checks	Local	high
362541	SUSE SLES15 Security Update : python-pymongo (SUSE-SU-2026:4398-1)	Nessus	SuSE Local Security Checks	Local	high
350276	Linux Distros Unpatched Vulnerability : CVE-2026-96749	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-96749

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high