FrançaisShown in its original language — a full translation is planned for a future version.
Multiples vulnérabilités dans les produits MongoDB
view advisory published 2026-10-26
A published security advisory; the vulnerabilities below are the ones it describes.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-115929US | — | — | ||
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA c… | ||||
| CVE-2026-114655US | — | — | ||
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses in… | ||||
| CVE-2026-114654US | — | — | ||
A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass… | ||||
| CVE-2026-114653US | — | — | ||
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression… | ||||
| CVE-2026-114652US | — | — | ||
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/… | ||||
| CVE-2026-114651US | — | — | ||
A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially c… | ||||
| CVE-2026-114650US | — | — | ||
A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under… | ||||
| CVE-2026-114649US | — | — | ||
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creat… | ||||
| CVE-2026-114648US | — | — | ||
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the f… | ||||
| CVE-2026-114647US | — | — | ||
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An applicati… | ||||
| CVE-2026-114646US | — | — | ||
A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from ex… | ||||
| CVE-2026-114645US | — | — | ||
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long cr… | ||||
| CVE-2026-114644US | — | — | ||
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes… | ||||
| CVE-2026-114643US | — | — | ||
The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that plac… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan