Mongodb Inc C Driver vulnerabilities

CVE-2026-93393 [HIGH] CWE-787 CVE-2026-93393: A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built wi A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No

CVE-2026-6231 [HIGH] CWE-20 CVE-2026-6231: The bson_validate function may return early on specific inputs and incorrectly report success. This The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data befor

CVE-2026-9100 [HIGH] CWE-1285 CVE-2026-9100: The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without a The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

CVE-2026-93395 [MEDIUM] CWE-191 CVE-2026-93395: A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index

CVE-2026-93394 [LOW] CWE-303 CVE-2026-93394: A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authenti A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a cont