class Response (com.mongodb.Response) reads data from the network to build up a response object for later processing. On line 70 it reads an integer into _num which is later used to create an ArrayList (line 78). This value however is not sanity checked which can lead to an OOM exception being thrown.

This affects at least versions 2.12.2 of the driver. The code for the 3.0 driver no longer contains this class but the new implementation should also contain a sanity check for this type of issue.