MongoDB C Driver

MongoDB BI Connector ODBC Driver Buffer Overflow in Setup Dialog
CVE-2026-19003 8.4 - High - August 12, 2026

A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.

Stack Overflow

MongoDB BI Connector ODBC Driver Mem Leak via Proc Outp Meta
CVE-2026-19004 8.8 - High - August 12, 2026

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

Heap-based Buffer Overflow

MongoDB BI Connector ODBC Driver Buffer Overflow in Float to Text Conversion
CVE-2026-18888 7.1 - High - August 12, 2026

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

Memory Corruption

MongoDB BI Connector ODBC Buf Overflow Metaretrieval
CVE-2026-19001 9.5 - Critical - August 12, 2026

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

Integer Overflow or Wraparound

Out-of-Bounds Write in MongoDB BI Connector ODBC Driver
CVE-2026-19002 8.8 - High - August 12, 2026

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

Classic Buffer Overflow

MongoDB Schema Manager & Atlas ODBC Driver OIDC Scheme Validation Flaw
CVE-2026-19503 6.3 - Medium - August 12, 2026

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

Improper Input Validation

MongoDB C Driver GridFS API divisionzero via malformed metadata
CVE-2026-9100 5.9 - Medium - May 20, 2026

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

Improper Validation of Specified Index, Position, or Offset in Input

MongoDB C Driver GSSAPI Username Canonicalization Heap Overflow
CVE-2026-6691 7.8 - High - May 06, 2026

The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.

Classic Buffer Overflow

MongoDB C Driver <1.30.5, 2.0.x: bson_validate Skips Validation Bypass
CVE-2026-6231 4.3 - Medium - April 13, 2026

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

Improper Input Validation

MongoDB C Driver Crash via Malformed HTTP Response (CVE-2026-4359)
CVE-2026-4359 2 - Low - March 17, 2026

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

Improper Neutralization of Null Byte or NUL Character

MongoDB GridFS chunkSize OOB buffer overflow
CVE-2025-14911 6.5 - Medium - January 27, 2026

User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.

Classic Buffer Overflow

Memory Disclosure via Large Options in MongoDB C Driver (mongoc_bulk_operation_t)
CVE-2025-12119 6.8 - Medium - November 18, 2025

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

Dangling pointer

MongoDB BI Connector ODBC Driver Default-Perm Priv Escalation v1.0.01.4.6
CVE-2025-12100 7.8 - High - October 23, 2025

Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.

Incorrect Default Permissions

Privilege Escalation in MongoDB Atlas SQL ODBC Driver 1.0.0-2.0.0 (Win)
CVE-2025-11575 7.8 - High - October 23, 2025

Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.

Incorrect Default Permissions

MongoDB C Driver <1.25.0 Infinite Loop in bson_utf8_validate
CVE-2023-0437 7.5 - High - January 12, 2024

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

Infinite Loop

MongoDB Driver before 5.8.0 Command Listener Logs Sensitive Auth Data
CVE-2021-32050 7.5 - High - August 29, 2023

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

Insertion of Sensitive Information into Log File

Privilege Escalation in MongoDB .NET/C# Driver <=2.18.0 via _t Discriminator
CVE-2022-48282 7.2 - High - February 21, 2023

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0 Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND * Application must be running on a Windows host using the full .NET Framework, not .NET Core AND * Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND * Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable

Marshaling, Unmarshaling

Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application
CVE-2021-20331 4.2 - Medium - May 13, 2021

Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser", and "updateUser" are executed. Without due care, an application may inadvertently expose this authenticated-related information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This issue affects the MongoDB C# Driver v2.12 versions prior to and including 2.12.1.

Information Disclosure

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values
CVE-2020-12135 - April 24, 2020

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.