CVE-2026-106438

Name of the Vulnerable Software and Affected Versions MongoDB C Driver (affected versions not specified)

Description An incorrect calculation in Decimal128 string parsing allows the driver to accept certain over-precision inputs containing leading zeros instead of rejecting them. This results in the production of a value that differs from the supplied text. An actor capable of providing a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.