CVE-2026-106438
MEDIUM
NVD
CVSS Score
4
Severity
MEDIUM
Published
Oct 08, 2026
Vendor
unknown
Description
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.