CVE-2026-126839
Gravedad CVSS v4.0:
BAJA
Tipo:
CWE-502
Deserialización de datos no confiables
Fecha de publicación:
13/11/2026
Última modificación:
13/11/2026
Descripción
*** Pendiente de traducción *** A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required.
Impacto
Puntuación base 4.0
2.30
Gravedad 4.0
BAJA
Puntuación base 3.x
4.20
Gravedad 3.x
MEDIA