{"id":"CVE-2025-12119","aliases":["DEBIAN-CVE-2025-12119","DLA-4438-1","EUVD-2025-198092","GHSA-mwcc-7vpp-xmv9","JLSEC-2026-181","OESA-2025-2821","OESA-2025-2822","OESA-2025-2823","OESA-2025-2824","OESA-2025-2890","OESA-2026-1745","UBUNTU-CVE-2025-12119"],"status":"published","title":"Bulk write with options may read invalid memory","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00212,"percentile":0.11634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-825"],"published":"2025-11-18T20:21:08Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"Packagist","package":"mongodb/mongodb-extension","fixed_in":["1.21.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"mongo-c-driver","fixed_in":["1.23.1-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mongo-c-driver","fixed_in":["1.30.4-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mongo-c-driver","fixed_in":["2.1.2-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"mongo-c-driver","fixed_in":["1.17.6-1+deb11u2"],"sources":["osv"]},{"ecosystem":"Julia","package":"MongoC_jll","fixed_in":["1.30.8+0"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"mongo-c-driver","fixed_in":["1.30.6-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"mongo-c-driver","fixed_in":["1.30.6-1.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"mongo-c-driver","fixed_in":["1.30.6-1.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"mongo-c-driver","fixed_in":["1.30.6-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"mongo-c-driver","fixed_in":["1.30.6-1.oe2403sp2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"mongodb/mongodb-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1+deb12u2"}]}],"versions":["1.23.1-1","1.23.1-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-1+deb13u1"}]}],"versions":["1.30.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1"}]}],"versions":["1.30.4-1","2.0.2-1","2.1.0-1","2.1.1-1"]},{"source":"osv","ecosystem":"Debian:11","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.6-1+deb11u2"}]}],"versions":["1.17.6-1","1.17.6-1+deb11u1"]},{"source":"osv","ecosystem":"Packagist","package":"mongodb/mongodb-extension","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.2"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.2.0","0.3.0","0.3.1","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3","1.0.0","1.0.0RC0","1.0.0alpha1","1.0.0alpha2","1.0.0beta1","1.0.0beta2","1.0.1","1.1.0","1.1.1","1.1.10","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.0alpha1","1.2.0alpha2","1.2.0alpha3","1.2.1","1.2.10","1.2.11","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.20.0","1.20.1","1.21.0","1.21.1"]},{"source":"osv","ecosystem":"Julia","package":"MongoC_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.30.8+0"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.4-2.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-2~ubuntu1","1.1.5-1~build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.3-1build1","1.3.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0-1","1.15.1-1","1.15.2-1","1.16.0-1","1.16.1-1","1.16.1-1build1","1.16.1-1build2","1.16.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.5-1build1","1.6.1-4","1.6.1-4build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0+1.7.5-2build2","1.11.1+1.9.2+1.7.5-4","1.12.0+1.9.2+1.7.5-3","1.12.0+1.9.2+1.7.5-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0-1","1.19.1-1","1.19.2-1","1.20.0-1","1.20.0-1build1","1.20.1-1","1.21.0-1","1.21.0-1build1","1.21.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0+1.11.1+1.9.2+1.7.5-1build1","1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu1","1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu2","1.15.0+1.11.1+1.9.2+1.7.5-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.3-1","1.24.4-1","1.25.1-1","1.25.2-1","1.25.4-1","1.26.0-1","1.26.0-1.1ubuntu1","1.26.0-1.1ubuntu2","1.26.0-1.1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30.2-1","1.30.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.21.0-1","2.0.0-1","2.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.7-0ubuntu1","2.1.7-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mongo-c-driver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30.4-1ubuntu1","2.2.0-1","2.2.1-1","2.2.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php-mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-1","2.1.7-0ubuntu1"]}],"products":[{"vendor":"mongodb","product":"c driver"},{"vendor":"mongodb","product":"c_driver"},{"vendor":"mongodb","product":"php driver"},{"vendor":"mongodb","product":"php_driver"},{"vendor":"mongodb inc.","product":"c driver"},{"vendor":"mongodb inc.","product":"php driver"}],"references":[{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.2","tags":["Release Notes","web","report"]},{"url":"https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6","tags":["Release Notes","web","report"]},{"url":"https://github.com/mongodb/mongo-c-driver/releases/tag/2.1.2","tags":["Release Notes","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00009.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12119","tags":["advisory"]},{"url":"https://github.com/mongodb/mongo-php-driver/commit/fa5b43366407bc0e5b0a919ed374decd9022b2f9","tags":["web"]},{"url":"https://jira.mongodb.org/browse/PHPC-2637","tags":["web"]},{"url":"https://github.com/mongodb/mongo-c-driver/commit/775998df7c67","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mwcc-7vpp-xmv9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12119.json","tags":["advisory"]},{"url":"https://github.com/mongodb/mongo-c-driver","tags":["package"]},{"url":"https://github.com/mongodb/mongo-php-driver","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-12119","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2821","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2822","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2823","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2824","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2890","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4359","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-12119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-12119","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-12119","title":"Bulk write with options may read invalid memory","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","status":"published","published":"2025-11-18T20:21:08.252Z","modified":"2026-01-14T19:04:31.839Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T14:32:41.743125Z"}],"euvd":[{"id":"EUVD-2025-198092","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","status":"published","published":"2025-11-18T20:21:08Z","modified":"2026-01-14T19:04:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:51.744142Z"}],"ghsa":[{"id":"GHSA-mwcc-7vpp-xmv9","title":"MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","status":"published","published":"2025-11-19T00:31:24Z","modified":"2026-03-24T14:41:33Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T14:39:41.724707Z"}],"nvd":[{"id":"CVE-2025-12119","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","status":"published","published":"2025-11-18T22:15:45.713Z","modified":"2026-10-07T21:10:00.2Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T14:11:44.669367Z"}],"osv":[{"id":"CVE-2025-12119","title":"Bulk write with options may read invalid memory","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","status":"published","published":"2025-11-18T20:21:08.252Z","modified":"2026-10-28T02:31:07.293766222Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"DEBIAN-CVE-2025-12119","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","status":"published","published":"2025-11-18T22:15:45.713Z","modified":"2026-10-08T09:47:29.97438757Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-mwcc-7vpp-xmv9","title":"MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","status":"published","published":"2025-11-19T00:31:24Z","modified":"2026-03-24T14:46:39.905693Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-825"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"JLSEC-2026-181","description":"A `mongoc_bulk_operation_t` may read invalid memory if large options are passed.","status":"published","published":"2026-04-23T15:10:48.547Z","modified":"2026-07-25T18:23:48.106656665Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2025-2821","title":"mongo-c-driver security update","description":"Security Fix(es):\n\nA mongoc_bulk_operation_t may read invalid memory if large options are passed.(CVE-2025-12119)","status":"published","published":"2025-12-12T11:09:57Z","modified":"2026-08-18T01:19:22.616735356Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2822","title":"mongo-c-driver security update","description":"Security Fix(es):\n\nA mongoc_bulk_operation_t may read invalid memory if large options are passed.(CVE-2025-12119)","status":"published","published":"2025-12-12T11:09:57Z","modified":"2026-08-18T01:19:22.453659549Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2823","title":"mongo-c-driver security update","description":"Security Fix(es):\n\nA mongoc_bulk_operation_t may read invalid memory if large options are passed.(CVE-2025-12119)","status":"published","published":"2025-12-12T11:09:57Z","modified":"2026-08-18T01:19:22.499176341Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2824","title":"mongo-c-driver security update","description":"Security Fix(es):\n\nA mongoc_bulk_operation_t may read invalid memory if large options are passed.(CVE-2025-12119)","status":"published","published":"2025-12-12T11:09:57Z","modified":"2026-08-18T01:19:22.511276006Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2890","title":"mongo-c-driver security update","description":"Security Fix(es):\n\nA mongoc_bulk_operation_t may read invalid memory if large options are passed.(CVE-2025-12119)","status":"published","published":"2025-12-30T11:10:01Z","modified":"2026-08-18T01:19:24.557178122Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1745","title":"mongo-c-driver security update","description":"mongo-c-driver is a project that includes two libraries: libmongoc, a client library\nwritten in C for MongoDB. libbson, a library providing useful routines related to\nbuilding, parsing, and iterating BSON documents.\r\n\r\nSecurity Fix(es):\n\nA mongoc_bulk_operation_t may read invalid memory if large options are passed.(CVE-2025-12119)\n\nA compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.(CVE-2026-4359)","status":"published","published":"2026-03-27T11:10:46Z","modified":"2026-08-18T01:19:42.820741577Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"UBUNTU-CVE-2025-12119","description":"A mongoc_bulk_operation_t may read invalid memory if large options are passed.","status":"published","published":"2025-11-18T22:15:00Z","modified":"2026-10-17T12:57:25.809373392Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"medium"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"DLA-4438-1","title":"mongo-c-driver - security update","status":"published","published":"2026-01-14T00:00:00Z","modified":"2026-01-14T17:30:07.089491Z","updated_at":"2026-11-02T15:46:12.7027Z"}]}}