Mongodb C Driver vulnerabilities

CVE-2026-114654 [MEDIUM] CWE-681 CVE-2026-114654: A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-o A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdec

CVE-2026-114644 [MEDIUM] CWE-770 CVE-2026-114644: The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its d The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated rem

CVE-2026-114643 [MEDIUM] CWE-694 CVE-2026-114643: The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the s

CVE-2026-81528 [MEDIUM] CWE-943 CVE-2026-81528: A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows t

CVE-2026-84963 [MEDIUM] CWE-681 CVE-2026-84963: An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an appl

CVE-2026-114650 [MEDIUM] CWE-838 CVE-2026-114650: A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configure

CVE-2026-81524 [MEDIUM] CWE-99 CVE-2026-81524: A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collectio A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one int

CVE-2026-93395 [MEDIUM] CWE-191 CVE-2026-93395: A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index

CVE-2026-106437 [MEDIUM] CWE-191 CVE-2026-106437: The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-by The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to

CVE-2021-20331 [MEDIUM] CWE-200 CVE-2021-20331: Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication- Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an

CVE-2026-81530 [MEDIUM] CWE-532 CVE-2026-81530: A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensi A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the

CVE-2026-114645 [MEDIUM] CWE-190 CVE-2026-114645: A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authenticat

CVE-2026-106431 [MEDIUM] CWE-787 CVE-2026-106431: An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching th

CVE-2026-88035 [MEDIUM] CWE-190 CVE-2026-88035: A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an u A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build

CVE-2026-84965 [MEDIUM] CWE-190 CVE-2026-84965: An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library m

CVE-2026-114647 [MEDIUM] CWE-943 CVE-2026-114647: The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the docu

CVE-2026-114651 [MEDIUM] CWE-908 CVE-2026-114651: A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residu

CVE-2020-12135 [MEDIUM] CWE-190 CVE-2020-12135: bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return v bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.

CVE-2026-93394 [LOW] CWE-303 CVE-2026-93394: A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authenti A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a cont

CVE-2026-84969 [LOW] CWE-787 CVE-2026-84969: A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a s A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may