MongoDB C# Driver CVE-2026-114644 Exposes Apps to Remote Denial of Service

The MongoDB C# Driver contains a high-severity vulnerability that allows remote attackers to crash applications. This flaw, tracked as CVE-2026-114644, impacts all driver versions released before 3.13.0.

What happened

The National Vulnerability Database records CVE-2026-114644 as a high-severity issue with a CVSS score of 8.2. The flaw resides in the BSON library component of the MongoDB C# Driver. According to the NVD record, the weakness is classified as CWE-770, indicating uncontrolled resource consumption. The vulnerability specifically affects how the library handles the deserialization of certain BSON value types.

Applications using this library retain data derived from deserialized content for the entire lifetime of the process. The NVD description states there is no limit on how much data accumulates during this retention period. An unauthenticated remote party who can trigger the deserialization of untrusted content can exploit this behavior. By forcing the application to process specific BSON values, an attacker can drive unbounded memory growth within the host application.

Why it matters

This vulnerability allows for a denial-of-service attack against any application using the affected driver versions. The NVD record confirms that an attacker does not need authentication to exploit this flaw. The impact is limited to availability; there is no impact to confidentiality or integrity of the data. Crucially, the NVD states that no MongoDB server component is affected by this specific issue. The risk is isolated to the client-side C# Driver and the applications that depend on it.

Organizations running .NET applications that interact with MongoDB via this driver are at risk. If an application exposes an endpoint that accepts untrusted BSON data, it becomes a potential target. The unbounded memory growth can exhaust the available memory of the host application, leading to service disruption. This makes the flaw particularly dangerous for internet-facing services that process external inputs.

What to watch

• Monitor for any new advisories from MongoDB regarding version 3.13.0.
• Check internal logs for unusual memory spikes in C# applications.
• Verify that all production systems are running driver version 3.13.0 or later.
• Audit applications for endpoints that accept untrusted BSON deserialization requests.

Who needs to act first

Teams should prioritize updating internet-facing applications that accept external BSON data. Identify systems with direct network exposure to untrusted users or services. Update these high-risk environments first to mitigate the denial-of-service risk. Test the updated driver in a staging environment before rolling it out to production. Ensure you have recent backups of application configurations. If immediate updates are not possible, restrict network access to the affected services. Implement rate limiting on endpoints that trigger deserialization. Monitor application memory usage closely for signs of exploitation.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: MongoDB

• Scan your inventory for all applications using the MongoDB C# Driver.
• Verify the current version of the driver in each application.
• Plan an update to version 3.13.0 or later for all affected systems.
• Monitor application performance metrics for abnormal memory consumption.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which MongoDB components are affected by CVE-2026-114644?

Only the MongoDB C# Driver versions before 3.13.0 are affected; no server components are impacted.

Can an attacker steal data using this vulnerability?

No, the NVD record states there is no impact to confidentiality or integrity.

Is authentication required to exploit this flaw?

No, the NVD describes the attacker as an unauthenticated remote party.