WID-SEC-W-2026-3453

DeutschShown in its original language — a full translation is planned for a future version.

MongoDB C Driver und Entity Framework Core Provider: Mehrere Schwachstellen

view advisory published 2026-09-17

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um Informationen offenzulegen oder um einen Denial-of-Service-Zustand herbeizuführen.

describes (5)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-93395US	—	0.40% (34th)	—	2026-09-17
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function rea…
CVE-2026-93394US	—	0.32% (25th)	—	2026-09-17
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was de…
CVE-2026-93393US	—	0.47% (40th)	—	2026-09-17
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects…
CVE-2026-92758US	—	0.15% (4th)	—	2026-09-17
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure ac…
CVE-2026-92757US	—OT elevated	0.07% (0th)	—	2026-09-17
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.