Advisoriesby IbisConnection-option injection via unescaped settings in the canonical MongoDB URL builder
Impact
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings.
Patches
Fixed in 3.11.1. User-supplied values are percent-encoded when the connection
URL is built, and host names containing URL delimiters are now rejected rather
than accepted.
Note that this changes the output of the URL builder for values containing
reserved characters, and makes invalid host names throw. Applications that
compare or store canonical connection URLs, or that pass unusual host names,
may see a difference after upgrading.
Workarounds
Configure the client directly through its settings object instead of building a
connection URL and parsing it back, so untrusted values are never re-interpreted
as connection options.
Otherwise, make sure to validate any untrusted input before it
reaches the URL builder, including values used to compose a host name.
References...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| MongoDB.Driver NuGet | >= 2.0.0, < 3.11.1 | 3.11.1 |
Details and references
### Impact Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connection options. A low-privileged user of such an application can thereby introduce or suppress security-relevant connection settings. ### Patches Fixed in 3.11.1. User-supplied values are percent-encoded when the connection URL is built, and host names containing URL delimiters are now rejected rather than accepted. Note that this changes the output of the URL builder for values containing reserved characters, and makes invalid host names throw. Applications that compare or store canonical connection URLs, or that pass unusual host names, may see a difference after upgrading. ### Workarounds Configure the client directly through its settings object instead of building a connection URL and parsing it back, so untrusted values are never re-interpreted as connection options. Otherwise, make sure to validate any untrusted input before it reaches the URL builder, including values used to compose a host name. ### References [CSHARP-6171](https://jira.mongodb.org/browse/CSHARP-6171), [Fix](https://github.com/mongodb/mongo-csharp-driver/commit/f588b9d841f8677ad337ddd8d1a7dd5ac649ad59), [CVE](https://www.cve.org/CVERecord?id=CVE-2026-81529)
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-88