PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
High8.3CVE-2026-96748 · Published Sep 24, 2026
### Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list. ### Impact An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it. Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected. ### Patches Fixed in PyMongo TBD. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and ...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| pymongo PyPI | >= 3.5.0, < 4.18.2 | 4.18.2 |
Details and references
### Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list. ### Impact An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it. Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected. ### Patches Fixed in PyMongo TBD. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`. ### Workarounds Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI. ### Details The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where `unquote_plus` was applied to the whole host section in `_validate_uri` and, later, `_parse_srv`, before the string was split on `,` and `:`.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-177
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 24 | PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding | High7.5 | 4.18.2 |
| Sep 24 | MongoDB: improper input validation | Medium5.3 | 4.18.2 |
| Sep 24 | Improper neutralization of special elements in data query logic in the cache... | High7.1 | 5.11.0 |
| Sep 24 | MongoDB Compass: code injection | High7.3 | 1.49.12 |
| Sep 24 | Heap buffer overflow via mid-scan command list growth in client topology monitoring | High8.3 | 1.30.12+1 more |
| Sep 24 | PHP object injection via unsuppressible __pclass class inference in command monitoring events | Medium6.3 | 1.21.10+2 more |