MongoDB C Driver bson_validate UTF-8 Validation Bypass (CDRIVER-6017)

MongoDB C Driver Vulnerability Summary Overview A flaw exists in the function of the MongoDB C Driver, where validation fails to correctly detect and report errors when strings or keys contain invalid UTF-8 sequences. Impact Scope Affected Versions: 2.6.2, 1.30.5, 2.1.0 Trigger Condition: When input data contains invalid UTF-8 sequences, the function incorrectly returns success instead of reporting validation failure. Remediation Fixed Versions: 2.6.2, 1.30.5, 2.1.0 Fix Details: Ensure that the function properly reports an error upon encountering invalid UTF-8 sequences. Related Issue Issue ID: CDRIVER-6017 Status: Closed Created: May 19, 2025 Updated: Jun 09, 2025 Detailed Description Problem Statement: The function should return an error when checking UTF-8 text elements that contain invalid UTF-8 sequences. However, because the function terminates early before validation, fails to correctly detect these invalid sequences. Specific Behavior: When input data includes invalid UTF-8 sequences, the function erroneously returns success instead of reporting validation failure. Related Issue Links PHIN-6992: Investigate changes in CDRIVER-6017: bson_valid... CXX-3902: Bump minimum C Driver version to 2.0.2 CXX-3903: bson_validate returns byte offset relative to l... PHIN-6992: Investigate changes in CDRIVER-6017: bson_valid... Activity Log May 19, 2025 00:37:37 PM UTC: Created Apr 13, 2026 03:25:05 PM UTC: Updated Jun 09, 2025 04:34:27 PM UTC: Resolved

Goal Reached Thanks to every supporter — we hit 100%!

MongoDB C Driver bson_validate UTF-8 Validation Bypass (CDRIVER-6017)