CVE-2026-96749

A flaw was found in pymongo. An integer overflow exists in the bundled native extension for Binary JSON (BSON) document encoding when processing an unusually large amount of data. An unprivileged attacker who can submit oversized data to an application for encoding can trigger an arithmetic overflow, resulting in a write outside the boundaries of an allocated memory buffer. This issue can lead to arbitrary code execution within the application process or a denial of service (DoS) via an application crash.

This vulnerability is rated as Moderate severity by Red Hat Product Security because exploitation requires an application to accept and serialize massive quantities of untrusted input into a single document, which typically triggers application crashes or memory exhaustion rather than arbitrary code execution. PyMongo is embedded within containerized runtimes and service stacks, where default memory quotas and standard request size restrictions substantially limit exposure. Consequently, the primary impact in practical deployment scenarios is confined to denial of service through process termination.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.