MongoDB C# Driver BSON Deserialization Causes Unbounded Memory Growth

The MongoDB C# Driver contains a high-severity vulnerability in its BSON library that permits uncontrolled resource consumption. Applications using this component to deserialise untrusted content are exposed to remote denial of service attacks. The issue stems from how the library handles specific BSON value types during the deserialization process, allowing attackers to manipulate memory usage without authentication.

Root cause

The vulnerability arises because the library retains data derived from deserialized content for the entire lifetime of the application process. There is no internal limit on how much data accumulates from these operations. Consequently, an attacker can drive unbounded memory growth by supplying crafted inputs, eventually exhausting the host application’s available memory and causing a service outage.

Attack path

An unauthenticated remote party can exploit this weakness if they can cause the application to deserialize specific content. The attacker does not need valid credentials or access to the MongoDB server itself. By sending requests that trigger the deserialization of the vulnerable BSON value type, they force the application to allocate increasing amounts of memory until the process fails or becomes unresponsive.

Affected versions

• MongoDB C# Driver versions before 3.13.0 are affected by CVE-2026-114644.
• The vulnerability is rated CVSS 8.2 HIGH by the National Vulnerability Database.
• The flaw is classified under CWE-770 for uncontrolled resource consumption.

Mitigation

• Upgrade the MongoDB C# Driver to version 3.13.0 or later to resolve the issue.
• Validate and sanitize all external data before passing it to the BSON deserialization layer.
• Implement application-level resource limits to constrain memory usage during deserialization tasks.
• Monitor process memory consumption for sudden spikes indicative of resource exhaustion attempts.

Signals worth monitoring

Teams usually observe gradual or rapid increases in application memory usage that do not correlate with normal traffic patterns. Check whether log files show repeated deserialization events from single or distributed sources. Look for out-of-memory errors or application restarts triggered by memory pressure. First containment moves involve isolating affected application instances and restarting services to reclaim memory. Review network logs for unusual payload sizes targeting deserialization endpoints.

What to do and how to stay safe: MongoDB

• Inventory all applications using the MongoDB C# Driver to identify those running versions before 3.13.0.
• Monitor application memory metrics for abnormal growth patterns that suggest resource exhaustion.
• Restrict inbound traffic to deserialization endpoints using network access controls where possible.
• Plan an upgrade path to version 3.13.0 once the vendor provides an update or patch.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability affect the MongoDB server itself?

No, the source material states that no MongoDB server component is affected by this issue.

Is there a confidentiality or integrity impact?

There is no impact to confidentiality or integrity; the flaw only allows denial of service.

Which CVE ID covers this vulnerability?

The vulnerability is tracked as CVE-2026-114644 in the National Vulnerability Database.