MongoDB C Driver

libbson Integer Underflow in bson_new_from_buffer Allows DOS via Crafted BSON
CVE-2026-93395 6.9 - Medium - September 17, 2026

A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.

Integer underflow

SCRAM Nonce Mismatch in libmongoc Lets MITM Capture Client Proof
CVE-2026-93394 6.3 - Medium - September 17, 2026

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.

Incorrect Implementation of Authentication Algorithm

MongoDB C Driver: Heap Buffer Overflow in TLS Layer (CVE-2026-93393)
CVE-2026-93393 9.2 - Critical - September 17, 2026

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process.

Memory Corruption

CVE-2026-88036: MongoDB C Driver GridFS Injection
CVE-2026-88036 6.1 - Medium - September 10, 2026

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Improper Neutralization of Special Elements in Data Query Logic

MongoDB C Driver OOB Write via SASL Auth Username Wraparound
CVE-2026-88035 5.7 - Medium - September 10, 2026

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

Integer Overflow or Wraparound

MongoDB C++ Driver GridFS Query Injection Vulnerability
CVE-2026-88034 6.1 - Medium - September 10, 2026

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Improper Neutralization of Special Elements in Data Query Logic

MongoDB C# Driver Regex Injection via LINQ Query Translation
CVE-2026-88026 7.1 - High - September 10, 2026

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a value may cause the application to return records beyond those intended by the original filter.

Improper Neutralization of Special Elements in Data Query Logic

MongoDB C# Driver GridFS Query Injection via Improper Identifier Neutralization
CVE-2026-88025 6.1 - Medium - September 10, 2026

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

Improper Neutralization of Special Elements in Data Query Logic

MongoDB C Driver BSON JSON Parsing Numeric Conversion Error
CVE-2026-84963 6.3 - Medium - September 03, 2026

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

Incorrect Conversion between Numeric Types

Double Free in OpenSSL TLS Cert Rev Path of MongoDB C Driver
CVE-2026-84964 8.2 - High - September 03, 2026

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

Double-free

BSON Integer Wraparound Enables Unauth DOS via Large JSON
CVE-2026-84965 5.9 - Medium - September 03, 2026

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

Integer Overflow or Wraparound

MongoDB C++ Driver: BSON Length Conv Bug Causing Crash
CVE-2026-84966 5.9 - Medium - September 03, 2026

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.

Incorrect Conversion between Numeric Types

MongoDB C Driver OOB Write in BSONJSON Binary Conversion
CVE-2026-84969 6.3 - Medium - September 03, 2026

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.

Memory Corruption

MongoDB C++ Driver BSON JSON Parse Truncation & Overread
CVE-2026-84970 5.9 - Medium - September 03, 2026

A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.

Incorrect Conversion between Numeric Types

Memory-safety Bypass via Long LIMIT Digits in MongoDB BI Connector
CVE-2026-81533 6 - Medium - August 28, 2026

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.

Stack Overflow

MongoDB ODBC Connector DB Overwrite CVE-2026-81532
CVE-2026-81532 8.7 - High - August 28, 2026

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.

Stack Overflow

MongoDB C# Driver Exposes Key Material in Diagnostics
CVE-2026-81530 6.8 - Medium - August 27, 2026

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked as other secret fields are. A party able to read the application's logs, diagnostic output, or a process memory dump may thereby recover the plaintext credentials and use them to decrypt protected field data.

Insertion of Sensitive Information into Log File

MongoDB C# Driver Connection-URL Delim Injection
CVE-2026-81529 7.1 - High - August 27, 2026

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.

Argument Injection

MongoDB C# Driver: Unvalidated Replacement Allows MongoDB Query Injection
CVE-2026-81528 5.3 - Medium - August 27, 2026

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted, loosely-typed input as a replacement value therefore allows that input to be interpreted by the database as update logic rather than as data, executing under the application's own database credentials. Applications using strongly-typed document mappings are not affected.

Improper Neutralization of Special Elements in Data Query Logic

MongoDB C# Driver NoSQL Injection in Aggregation Translation
CVE-2026-81527 6.9 - Medium - August 27, 2026

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. When application-supplied values are embedded in certain query constructs, special elements contained within those values are not properly escaped before the resulting query is transmitted to the database, so portions of the value may be interpreted by the database as query logic rather than as data. A user able to supply values that an application incorporates into an affected query may thereby cause unintended data to be returned or query results to be altered.

Improper Neutralization of Special Elements in Data Query Logic

MongoDB C Driver Namespace Sanitization Flaw Enables Arbitrary Targeting
CVE-2026-81524 5.3 - Medium - August 27, 2026

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.

Insecure Direct Object Reference

MongoDB C++ Driver Namespace Injection Enables Limited Unauthorized Access
CVE-2026-81522 8.6 - High - August 27, 2026

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to another logical tenant of the affected application.

Output Sanitization

MongoDB BI Connector ODBC Driver Buffer Overflow in Setup Dialog
CVE-2026-19003 8.4 - High - August 12, 2026

A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.

Stack Overflow

MongoDB BI Connector ODBC Driver Mem Leak via Proc Outp Meta
CVE-2026-19004 8.8 - High - August 12, 2026

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

Heap-based Buffer Overflow

MongoDB BI Connector ODBC Driver Buffer Overflow in Float to Text Conversion
CVE-2026-18888 7.1 - High - August 12, 2026

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

Memory Corruption

MongoDB BI Connector ODBC Buf Overflow Metaretrieval
CVE-2026-19001 9.5 - Critical - August 12, 2026

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

Integer Overflow or Wraparound

Out-of-Bounds Write in MongoDB BI Connector ODBC Driver
CVE-2026-19002 8.8 - High - August 12, 2026

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

Classic Buffer Overflow

MongoDB Schema Manager & Atlas ODBC Driver OIDC Scheme Validation Flaw
CVE-2026-19503 6.3 - Medium - August 12, 2026

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

Improper Input Validation

MongoDB C Driver GridFS API divisionzero via malformed metadata
CVE-2026-9100 5.9 - Medium - May 20, 2026

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

Improper Validation of Specified Index, Position, or Offset in Input

MongoDB C Driver GSSAPI Username Canonicalization Heap Overflow
CVE-2026-6691 7.8 - High - May 06, 2026

The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.

Classic Buffer Overflow

MongoDB C Driver <1.30.5, 2.0.x: bson_validate Skips Validation Bypass
CVE-2026-6231 4.3 - Medium - April 13, 2026

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

Improper Input Validation

MongoDB C Driver Crash via Malformed HTTP Response (CVE-2026-4359)
CVE-2026-4359 2 - Low - March 17, 2026

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

Improper Neutralization of Null Byte or NUL Character

MongoDB GridFS chunkSize OOB buffer overflow
CVE-2025-14911 6.5 - Medium - January 27, 2026

User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.

Classic Buffer Overflow

Memory Disclosure via Large Options in MongoDB C Driver (mongoc_bulk_operation_t)
CVE-2025-12119 6.8 - Medium - November 18, 2025

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

Dangling pointer

MongoDB BI Connector ODBC Driver Default-Perm Priv Escalation v1.0.01.4.6
CVE-2025-12100 7.8 - High - October 23, 2025

Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.

Incorrect Default Permissions

Privilege Escalation in MongoDB Atlas SQL ODBC Driver 1.0.0-2.0.0 (Win)
CVE-2025-11575 7.8 - High - October 23, 2025

Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.

Incorrect Default Permissions

MongoDB C Driver <1.25.0 Infinite Loop in bson_utf8_validate
CVE-2023-0437 7.5 - High - January 12, 2024

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

Infinite Loop

MongoDB Driver before 5.8.0 Command Listener Logs Sensitive Auth Data
CVE-2021-32050 7.5 - High - August 29, 2023

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

Insertion of Sensitive Information into Log File

Privilege Escalation in MongoDB .NET/C# Driver <=2.18.0 via _t Discriminator
CVE-2022-48282 7.2 - High - February 21, 2023

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0 Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND * Application must be running on a Windows host using the full .NET Framework, not .NET Core AND * Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND * Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable

Marshaling, Unmarshaling

Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application
CVE-2021-20331 4.2 - Medium - May 13, 2021

Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.

Information Disclosure

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values
CVE-2020-12135 - April 24, 2020

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.