MongoDB security advisories

174 advisories · 102 critical or high in 12 months · latest Oct 26

Advisories page

60 of 174 advisories

High 7.6Oct 26

MongoDB mongosh: improper certificate validationCVE-2026-115930fixed in 2.14.0 High 7.6Oct 24

MongoDB Compass: improper certificate validationCVE-2026-115929fixed in 1.53.1 Medium 6.0Oct 22

MongoDB libmongocrypt: injectionCVE-2026-114655fixed in 1.21.1 Medium 6.3Oct 22

MongoDB C# Driver: unsafe deserializationCVE-2026-114651fixed in 3.13.0 High 7.1Oct 22

A data-query-logic neutralization weakness in the update-statement construction...CVE-2026-114652fixed in 3.13.0 High 7.1Oct 22

A client-side encryption schema construction component in the MongoDB C# Driver...CVE-2026-114653fixed in 3.13.0 Medium 6.9Oct 22

A numeric-type conversion flaw in the BSON handling library of the MongoDB C#...CVE-2026-114654fixed in 3.13.0 High 8.2Oct 22

MongoDB C# Driver: resource exhaustionCVE-2026-114644fixed in 3.13.0 Medium 5.7Oct 22

MongoDB C Driver: integer overflowCVE-2026-114645fixed in 1.30.14 +1 Medium 6.9Oct 22

A data-validation flaw exists in the BSON handling and binary serialization...CVE-2026-114646fixed in 3.13.0 Medium 5.3Oct 22

The MongoDB C# Driver does not reject replacement documents whose top-level...CVE-2026-114647fixed in 3.13.0 High 7.2Oct 22

The MongoDB C# Driver does not neutralize dot and dollar characters in...CVE-2026-114648fixed in 3.13.0 High 7.6Oct 22

The MongoDB C# Driver compares TLS client certificates by issuer and serial...CVE-2026-114649fixed in 3.13.0 Medium 6.9Oct 22

A flaw in the client-side encryption support of the MongoDB .NET/C# driver can...CVE-2026-114650fixed in 3.13.0 Medium 5.3Oct 22

The MongoDB C# Driver writes GeoJSON extra members without checking whether...CVE-2026-114643fixed in 3.13.0 High 8.6Oct 21

MongoDB Compass: improper output encodingCVE-2026-113870fixed in 1.49.15 Medium 6.0Oct 8

Query and rename target confusion via embedded NUL truncation in MongoDB C++ DriverCVE-2026-106430fixed in 4.6.1 High 8.2Oct 8

MongoDB Go Driver: integer overflowCVE-2026-107324fixed in 1.2.0 +1 High 8.2Oct 8

MongoDB Go Driver: denial of serviceCVE-2026-107325fixed in 1.* +1 High 8.7Oct 8

MongoDB libmongocrypt: type confusionCVE-2026-106433fixed in 1.20.5 Medium 5.9Oct 8

MongoDB C Driver: integer underflowCVE-2026-106437fixed in 1.30.13 +1 Medium 5.1Oct 8

An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver...CVE-2026-106438fixed in 1.30.13 +1 High 7.5Sep 24

PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encodingCVE-2026-96749fixed in 4.18.2 High 8.3Sep 24

PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimitersCVE-2026-96748fixed in 4.18.2 Medium 5.3Sep 24

MongoDB: improper input validationCVE-2026-96747fixed in 4.18.2 High 7.1Sep 24

Improper neutralization of special elements in data query logic in the cache...CVE-2026-96744fixed in 5.11.0 High 7.3Sep 24

MongoDB Compass: code injectionCVE-2026-96750fixed in 1.49.12 High 8.3Sep 24

Heap buffer overflow via mid-scan command list growth in client topology monitoringCVE-2026-96746fixed in 1.30.12 +1 Medium 6.3Sep 24

PHP object injection via unsuppressible __pclass class inference in command monitoring eventsCVE-2026-96745fixed in 1.21.10 +2 Critical 9.2Sep 18

MongoDB Mongoid: unsafe reflectionCVE-2026-93762no fix yet High 7.1Sep 18

MongoDB Mongoid: information disclosureCVE-2026-93763no fix yet High 7.1Sep 18

MongoDB Mongoid: cleartext storageCVE-2026-93764no fix yet High 8.8Sep 18

MongoDB Mongoid: code injectionCVE-2026-93759no fix yet High 8.3Sep 18

Mongoid does not restrictCVE-2026-93760no fix yet High 8.7Sep 18

MongoDB Mongoid: regular expression denial of serviceCVE-2026-93761no fix yet High 8.6Sep 18

MongoDB Mongoid: insecure direct object referenceCVE-2026-93758no fix yet High 8.3Sep 18

MongoDB Mongoid: unsafe reflectionCVE-2026-93765no fix yet High 8.1Sep 18

Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamCVE-2026-93393fixed in 1.30.11 +1 Medium 5.7Sep 17

Insertion of Sensitive Information into Log FileCVE-2026-92758fixed in 8.4.4 Medium 6.8Sep 17

Silent plaintext storage of encrypted fields via mis-keyed encryption map in the EF Core providerCVE-2026-92757fixed in 8.4.4 Medium 6.3Sep 17

A flaw in libmongoc's SCRAM authentication implementation caused the client to...CVE-2026-93394fixed in 2.3.2 Medium 6.9Sep 17

MongoDB C Driver: integer overflowCVE-2026-93395fixed in 2.3.1 Medium 6.8Sep 17

MongoDB Entity Framework Core Provider: missing encryptionCVE-2026-92756fixed in 8.4.3 +2 Medium 6.1Sep 15

RUBY-3941 Require exact match when reading/writing GridFS via IDCVE-2026-88030fixed in 2.26.0 Medium 6.1Sep 15

PYTHON-5994 Use exact match for file ID in GridFS delete methodsCVE-2026-88029fixed in 4.18.1 High 7.7Sep 11

MongoDB Server: race conditionCVE-2026-89099fixed in 8.3.11 +2 High 7.1Sep 11

### Impact Improper neutralization of special elements in data query logic in...CVE-2026-88027fixed in 5.11.0 High 7.1Sep 11

### Impact Improper neutralization of special elements in data query logic in...CVE-2026-88028fixed in 5.11.0 High 8.4Sep 11

### Impact Improper neutralization of special elements in data query logic in...CVE-2026-88022fixed in 5.11.0 Medium 6.1Sep 11

GridFS data disclosure and deletion via query-operator injection in file IDsCVE-2026-88023fixed in 1.21.5 +1 Medium 6.1Sep 11

GridFS data disclosure and deletion via query-operator injection in file IDsCVE-2026-88034fixed in 4.5.3 Medium 5.7Sep 11

Heap buffer overflow via wrapped size check during SASL username canonicalizationCVE-2026-88035fixed in 2.5.3 Medium 6.1Sep 11

GridFS data disclosure and deletion via query-operator injection in file IDsCVE-2026-88036fixed in 1.30.10 +1 High 8.2Sep 10

Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java DriverCVE-2026-88032fixed in 5.11.1 +1 High 8.3Sep 10

GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java DriverCVE-2026-88033fixed in 5.11.1 +1 High 7.1Sep 10

Regular expression injection via unescaped characters in LINQ query translationCVE-2026-88026fixed in 3.11.2 Medium 6.1Sep 10

GridFS data disclosure and deletion via query-operator injection in file IDsCVE-2026-88025fixed in 3.11.2 Medium 6.1Sep 10

GridFS data deletion via operator-document injection in file IDsCVE-2026-88031fixed in 1.17.10 +1 Medium 6.1Sep 10

GridFS data disclosure and deletion via query-operator injection in file IDsCVE-2026-88024fixed in 3.9.1 High 7.1Sep 8

MongoDB Server: weakly protected credentialsCVE-2026-82070fixed in 8.3.9 +2

About MongoDB

Security advisories MongoDB publishes for its own products.

www.mongodb.com/resources/products/mongodb-security-bulletins MongoDB

MongoDB elsewhere on Ibis: Acquisitions · Quarterly · Paydays · Releases · Repos · TechConf