Mongodb C Driver vulnerabilities

CVE-2026-93393 [HIGH] CWE-787 CVE-2026-93393: A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built wi A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No

CVE-2026-88025 [HIGH] CWE-943 CVE-2026-88025: Improper neutralization of special elements in data query logic in the GridFS component of the Mongo Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored fi

CVE-2026-88036 [HIGH] CWE-943 CVE-2026-88036: Improper neutralization of special elements in data query logic in the GridFS component of the Mongo Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored fil

CVE-2022-48282 [HIGH] CWE-502 CVE-2022-48282: Under very specific circumstances (see Required configuration section below), a privileged user is a Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0 Following configuration must be t

CVE-2026-114648 [HIGH] CWE-943 CVE-2026-114648: The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can

CVE-2026-6231 [HIGH] CWE-20 CVE-2026-6231: The bson_validate function may return early on specific inputs and incorrectly report success. This The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data befor

CVE-2024-7553 [HIGH] CWE-284 CVE-2024-7553: Incorrect validation of files loaded from a local untrusted directory may allow local privilege esca Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 ver

CVE-2021-32050 [HIGH] CWE-200 CVE-2021-32050: Some MongoDB Drivers may erroneously publish events containing authentication-related data to a comm Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g.,

CVE-2026-6691 [HIGH] CWE-120 CVE-2026-6691: The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonic The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.

CVE-2026-84964 [HIGH] CWE-415 CVE-2026-84964: A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting

CVE-2026-114649 [MEDIUM] CWE-1025 CVE-2026-114649: The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when decidin The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private

CVE-2026-96746 [MEDIUM] CWE-787 CVE-2026-96746: An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unaut An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

CVE-2026-114652 [MEDIUM] CWE-943 CVE-2026-114652: A data-query-logic neutralization weakness in the update-statement construction component of the Mon A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, with

CVE-2026-114653 [MEDIUM] CWE-185 CVE-2026-114653: A client-side encryption schema construction component in the MongoDB C# Driver places caller-suppli A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silen

CVE-2026-114646 [MEDIUM] CWE-130 CVE-2026-114646: A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# D A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the amount of data actually provided, and it copies th

CVE-2023-0437 [HIGH] CWE-835 CVE-2023-0437: When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

CVE-2026-81529 [HIGH] CWE-88 CVE-2026-81529: Improper neutralization of delimiters in connection-URL construction allows connection-option inject Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters

CVE-2026-81527 [MEDIUM] CWE-943 CVE-2026-81527: A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of t A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting

CVE-2026-9100 [HIGH] CWE-1285 CVE-2026-9100: The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without a The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

CVE-2026-88026 [MEDIUM] CWE-943 CVE-2026-88026: Improper neutralization of regular-expression metacharacters in the LINQ query translation component Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records bey