Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Medium | 6.9 | CVE-2026-114654 |
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to...
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114654A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to...
Executive summaryThe MongoDB C# Driver, a library used by .NET applications to talk to MongoDB databases, has a flaw that lets an out-of-range binary subtype value supplied through untrusted text input corrupt BSON output. The advisory does not state a severity rating. The fix is in driver release 3.13.0, and the advisory says users should review the behavior changes listed under each security fix before upgrading. Technical summaryThe flaw is a numeric-type conversion error in the BSON handling library that lets an out-of-range binary subtype value, supplied through untrusted textual input, corrupt BSON output and bypass UUID and OldBinary guards. The advisory's release notes describe it as CSHARP-6166 / CVE-2026-114654 and say the fix makes BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer reject binary subtypes outside 0 to 255. The affected version range is not stated in the text provided, and the advisory states the fixed version as 3.13.0. The advisory does not describe a workaround, detection guidance, or exploitation in the wild, and the attack preconditions beyond untrusted textual input are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-114653 |
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern...
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114653A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern...
Executive summaryA flaw in the MongoDB C# Driver's client-side field-level encryption schema builder can cause some fields to be silently left unencrypted. The advisory does not state a severity rating or CVSS score. The advisory points to the 3.13.0 driver release, whose notes describe the fix, and asks users to review the listed behavior changes before upgrading. Technical summaryThe weakness is an unescaped regular expression: caller-supplied field names passed to the CSFLE schema builder's PatternProperty are interpreted as patterns, which can silently bypass client-side encryption. The advisory does not state the attack vector, required privileges, or preconditions. Affected version numbers are not stated, though the release notes for the 3.13.0 driver list this as a security fix. The fix matches field names both as literal names and as regular expressions, and the PatternProperty overload that takes a field expression is marked obsolete in favor of Property. No workaround is stated. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.1 | CVE-2026-114652 |
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as...
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114652A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as...
Executive summaryThe advisory covers CVE-2026-114652, a data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver, where application-supplied values can be interpreted as update operators. The release notes for MongoDB C# Driver 3.13.0 list this as a security fix and note a behavior change in how single-value update builders render their output. The advisory does not state a severity score, and the vendor's recommendation is to review the listed behavior changes before upgrading. Technical summaryThe weakness is an update operator injection (CWE-style neutralization flaw) in the update builder of the MongoDB C# Driver, tracked as CSHARP-6168. The advisory text does not state the attack vector, required privileges, or preconditions, and it does not state a CVSS score. The affected version range is not explicitly stated in the excerpt, although the notes describe the fix as part of the 3.13.0 general availability release. The fix in 3.13.0 changes PushEach and AddToSetEach with a single value to always render $each, and PullAll with a single value to always render $pullAll, where previously a single value was unwrapped or rendered as $pull. No workaround and no detection guidance are stated in the excerpt, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityNone IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.3 | CVE-2026-114651 |
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when...
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver, MongoDB, Inc. .NET Driver
|
NVD | |||
|
CVE-2026-114651A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when...
Executive summaryThe advisory concerns CVE-2026-114651 in the MongoDB C# Driver, a component of MongoDB's .NET software. The flaw is a memory-handling weakness in the BSON deserialization component that may return leftover data from previously processed content. The advisory does not state a severity rating, and the fix is included in the 3.13.0 driver release, which the advisory says users should review before upgrading. Technical summaryThe weakness is described as a memory-handling issue in the BSON deserialization component, where data left over from previously processed content may be returned. Per the release notes, the issue is a cross-document data leak via malformed BSON array parsing in a reused thread buffer, tracked as CSHARP-6170. The attack vector, required privileges, and user interaction are not stated. The fixed version is stated as the 3.13.0 general availability release of the .NET driver, but affected version ranges are not stated. No workaround and no detection guidance are stated, and whether the issue has been exploited in the wild is not stated. No CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsMongoDB, Inc.MongoDB, Inc. MongoDB C# DriverMongoDB, Inc. .NET Driver
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.9 | CVE-2026-114650 |
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver, MongoDB, Inc. libmongocrypt, MongoDB, Inc. MongoDB.Libmongocrypt NuGet package, MongoDB, Inc. .NET/C# driver
|
NVD | |||
|
CVE-2026-114650A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption
Executive summaryThe advisory describes a flaw in the client-side encryption support of the MongoDB .NET/C# driver that can cause data meant for client-side field-level encryption to be written without encryption. It is fixed in the 3.13.0 release of the driver, which also addresses several other CVEs. The advisory does not state a severity rating, and the recommended action is to upgrade to version 3.13.0 after reviewing the listed behavior changes. Technical summaryThe CVE-2026-114650 item (CSHARP-6180) is described as plaintext exposure of encrypted fields caused by ANSI code-page corruption of the database name, which made databases with non-ASCII names fail to match schema map namespaces. The fix changes automatic encryption to pass the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page. The advisory does not state the attack vector, required privileges, or exploitation status. It does not give a CVSS score, and it does not state a workaround or detection guidance beyond upgrading to 3.13.0 and reviewing the behavior changes. The advisory lists the fixed release as 3.13.0 and does not name the affected version range for this specific CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X AffectsMongoDB, Inc.MongoDB, Inc. MongoDB C# DriverMongoDB, Inc. libmongocryptMongoDB, Inc. MongoDB.Libmongocrypt NuGet packageMongoDB, Inc. .NET/C# driver
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.6 | CVE-2026-114649 |
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114649The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections
Executive summaryThe advisory covers CVE-2026-114649 in the MongoDB C# Driver, where client TLS certificates are compared only by issuer and serial number when deciding whether two clients can share cached cluster connections. The advisory describes this as an authentication bypass. It is fixed in the 3.13.0 general availability release of the driver, and the vendor advises reviewing the listed behavior changes before upgrading. Technical summaryThe flaw is an authentication bypass caused by certificate equality checks that use only the issuer and serial number when deciding whether clients can share a cached cluster. The fix in 3.13.0 changes SslSettings to compare the full certificate by SHA-256 hash and whether a private key is present. The advisory does not state the attack vector, the preconditions an attacker needs, or the affected driver versions before 3.13.0. Affected version ranges, workarounds, exploitation status, CVSS score, and detection guidance are not stated. Upgrading to 3.13.0 is the only remediation the advisory describes. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.2 | CVE-2026-114648 |
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into...
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114648The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into...
Executive summaryThe MongoDB C# Driver, a library developers use to connect .NET applications to MongoDB databases, has a flaw in how it handles dot and dollar characters in LINQ query field names, dictionary keys, and array-filter identifiers. The advisory ties this to CVE-2026-114648, which it describes as query redirection through unvalidated string keys. The advisory does not state a severity score, and the fix is version 3.13.0 of the driver, which changes LINQ translation to reject affected names. Technical summaryThe weakness is a failure to neutralize dot and dollar characters in field names used in LINQ queries, which the advisory calls query redirection via unvalidated string keys spliced into filter field paths. The advisory does not state the attack vector, the privileges or preconditions required, or whether exploitation has occurred. The fix is in driver release 3.13.0 (CSHARP-6181), where LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names containing ".", names starting with "$" at the start of a path, and positional operators. The advisory does not state any workaround for earlier versions, and it provides no detection guidance. Users should review the behavior changes listed in the release notes before upgrading. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114647 |
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114647The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations
Executive summaryThe MongoDB C# Driver, in its 3.13.0 release, is affected by a flaw in which FindOneAndReplace does not reject replacement documents whose first top-level field name starts with a dollar sign, which could enable NoSQL operator injection. The advisory does not state a severity rating or a CVSS score. The release notes say the fix is to upgrade to driver version 3.13.0, where FindOneAndReplace now throws an error in this case, and users should review the listed behavior changes before upgrading. Technical summaryThe weakness is NoSQL operator injection (CVE-2026-114647, tracked as CSHARP-6186) caused by unvalidated replacement documents in FindOneAndReplace, which is described as inconsistent with other replace operations that already reject such documents. The advisory does not state the attack vector, required privileges, or preconditions. The fixed behavior is that FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, matching ReplaceOne. The advisory names 3.13.0 as the release containing the fix, but it does not state the affected version range or the vulnerable versions before that release. No workarounds and no detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.9 | CVE-2026-114646 |
A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114646A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver
Executive summaryThe advisory describes a set of security fixes in the MongoDB C# Driver, released as version 3.13.0, which addresses several CVEs including CVE-2026-114646. The fixes cover injection, denial of service, data leakage, and encryption and authentication bypass issues, and the advisory does not state an overall severity rating. The vendor recommends upgrading to 3.13.0 and reviewing the listed behavior changes before doing so. Technical summaryCVE-2026-114646 (CSHARP-6157) is described as NoSQL command injection caused by a mismatched raw BSON length prefix written verbatim to the wire. The fix makes writing a raw BSON document or array throw ArgumentException when its declared length is inconsistent with the buffer, and bytes past the declared length are ignored. The advisory does not state the attack vector, required privileges, or any workaround. The advisory does not state a CVSS score or whether the issue is exploited in the wild, and no detection guidance is given beyond the upgrade and behavior change notes. The fixed version is stated as 3.13.0 (the general availability release), and the advisory does not state which earlier versions are affected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.7 | CVE-2026-114645 |
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively...
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114645A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively...
Executive summaryA flaw in the MongoDB C Driver affects only Windows client builds that use the Windows-native authentication backend. The advisory rates it Moderate, with a CVSS 3.1 base score of 5.2, and says it can corrupt client process memory and crash the client application. The vendor's recommendation is to upgrade to patched versions 1.30.14 or 2.5.7. Technical summaryThe flaw is a 32-bit integer wraparound (CWE-190) in the Windows-only Kerberos/SSPI authentication code, which can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client connection configuration, leading to a heap overflow. The advisory's CVSS vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H, so exploitation requires local access, high complexity, high privileges, and control over the client-side configuration. Affected versions are >= 1.6.0 and < 1.30.14, and >= 2.0.0 and < 2.5.7; patched versions are 1.30.14 and 2.5.7. The advisory does not state any workaround, and it provides no detection guidance. It also does not state whether the issue has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-c-driver/secur…/GHSA-g9mw-2cwh-6hh9 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityHigh
How it is exploited
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.2 | CVE-2026-114644 |
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114644The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type
Executive summaryThe MongoDB C# Driver's BSON library contains a flaw that lets resource consumption grow without limit when it deserializes one BSON value type, which can exhaust memory and cause a denial of service. The advisory does not state a severity score. The fix is in the 3.13.0 release of the driver, and the advisory points users to review its behavior changes before upgrading. Technical summaryThe weakness is classified as uncontrolled resource consumption, specifically memory exhaustion from unbounded symbol interning during BSON and JSON deserialization of BsonSymbol values (tracked as CSHARP-6162). The advisory does not state the attack vector, the exact preconditions, or whether authentication is required. The affected version range is not stated, but the 3.13.0 general availability release notes list this fix. The fix stops interning BsonSymbol values and marks BsonSymbolTable obsolete, and users should use BsonSymbol.Create or implicit string conversion instead. The advisory does not state a workaround, a CVSS score, known exploitation in the wild, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-114643 |
The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-114643The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates
Executive summaryThe MongoDB C# Driver, in its 3.13.0 release, has a security flaw where GeoJSON extra members are written without checking whether their names collide with reserved GeoJSON members such as type and coordinates. The advisory does not state a severity rating or a CVSS score. The release notes say the fix is to upgrade to driver version 3.13.0, where GeoJSON serialization now throws an error when an extra member has the same name as a declared member. Technical summaryThe weakness is a duplicate-key BSON injection through GeoJSON extra members, tracked as CSHARP-6179 and CVE-2026-114643, which can override geometry values. The release notes describe the behavior change as GeoJSON serialization throwing BsonSerializationException when an extra member shares a name with a declared member, and this is the fix in driver 3.13.0. The advisory does not state the attack vector, the preconditions an attacker needs, or the affected driver versions before 3.13.0. It does not state a workaround or any detection guidance. The advisory does not state whether exploitation has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0 Impact if exploitedConfidentialityNone IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-106438 |
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-106438An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them
From the advisoryAn incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value. Impact if exploitedConfidentialityNone IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.9 | CVE-2026-106437 |
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-106437The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum
From the advisoryThe BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityHigh
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.9 | CVE-2026-106431 |
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific...
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-106431An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific...
From the advisoryAn off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size. Impact if exploitedConfidentialityNone IntegrityLow AvailabilityHigh
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.0 | CVE-2026-106430 |
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-106430The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API
From the advisoryThe MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials. Impact if exploitedConfidentialityLow IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.3 | CVE-2026-106428 |
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message
MongoDB, Inc.MongoDB, Inc. MongoDB C# Driver
|
NVD | |||
|
CVE-2026-106428An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message
From the advisoryAn out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||