GHSA-86gh-39m5-hhg6

Duplicate Advisory: PYTHON-6110 Out-of-bounds read in BSON decoding via a malformed Regex element

Published

2026-10-08

Modified

2026-10-27

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-98qm-wvgf-w4cf. This link is maintained to preserve external references. ## Original Description The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-86gh-39m5-hhg6