{"id":"CVE-2026-106438","published":"2026-10-08T19:16:59.703","lastModified":"2026-10-08T20:49:23.240","description":"An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.","cvssScore":4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-682"],"vendors":[],"products":[],"references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6419","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}