{"id":"CVE-2026-96748","aliases":["AZL-105107","CLSA-2026-1792396649","DEBIAN-CVE-2026-96748","EUVD-2026-86347","GHSA-vp6j-j7w5-5xjj","PYSEC-2026-4297","ROOT-APP-PYPI-CVE-2026-96748","SUSE-SU-2026:4398-1","UBUNTU-CVE-2026-96748","openSUSE-SU-2026:11935-1","openSUSE-SU-2026:22003-1"],"status":"published","title":"Connection redirection via percent-encoded delimiter injection in connection string hosts","description":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00361,"percentile":0.30245,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-177"],"published":"2026-09-24T18:18:12Z","modified":"2026-11-05T11:15:07Z","fixes":[{"ecosystem":"PyPI","package":"pymongo","fixed_in":["4.18.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"pymongo","fixed_in":["4.18.2-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"pymongo","fixed_in":["4.18.1+aikido.1","4.18.1+aikido.2","4.17.0+aikido.2","4.9.2+aikido.2","4.16.0+aikido.1","4.6.3+aikido.3","4.10.1+aikido.1","4.10.1+aikido.2","4.8.0+aikido.2","4.18.0+aikido.2","4.9.2+aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"last_affected":"4.18.1"},{"fixed":"4.18.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.0-9"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0"},{"fixed":"3.13.0.post2+tuxcare"}]}],"versions":["3.13.0","3.13.0.post1+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0-1","3.11.0-1+deb12u1","4.10.1-1","4.10.1-2","4.10.1-3","4.10.1-4","4.10.1-5","4.10.1-6","4.15.3-1","4.15.3-2","4.15.4-1","4.15.4-2","4.15.5-1","4.16.0-1","4.17.0-1","4.18.1-1","4.18.2-1","4.7.3-1","4.7.3-2"]},{"source":"osv","ecosystem":"Debian:13","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.1-6","4.15.3-1","4.15.3-2","4.15.4-1","4.15.4-2","4.15.5-1","4.16.0-1","4.17.0-1","4.18.1-1","4.18.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-1"}]}],"versions":["4.10.1-6","4.15.3-1","4.15.3-2","4.15.4-1","4.15.4-2","4.15.5-1","4.16.0-1","4.17.0-1","4.18.1-1"]},{"source":"osv","ecosystem":"PyPI","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"4.18.2"}]}],"versions":["3.10.0","3.10.1","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.1","3.12.2","3.12.3","3.13.0","3.5.0","3.5.1","3.6.0","3.6.1","3.7.0","3.7.1","3.7.2","3.8.0","3.9.0","4.0","4.0.1","4.0.2","4.1.0","4.1.1","4.10.0","4.10.1","4.11","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.13.0","4.13.0.dev0","4.13.1","4.13.2","4.14.0","4.14.1","4.15.0","4.15.1","4.15.2","4.15.3","4.15.4","4.15.5","4.16.0","4.16.0.dev0","4.17.0","4.18.0","4.18.1","4.2.0","4.3.2","4.3.3","4.4.0","4.4.0b0","4.4.1","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.7.0","4.7.1","4.7.2","4.7.3","4.8.0","4.8.0b0","4.9","4.9.1","4.9.2"]},{"source":"osv","ecosystem":"PyPI","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"4.18.2"}]}],"versions":["3.10.0","3.10.1","3.11.0","3.11.1","3.11.2","3.11.3","3.11.4","3.12.0","3.12.1","3.12.2","3.12.3","3.13.0","3.5.0","3.5.1","3.6.0","3.6.1","3.7.0","3.7.1","3.7.2","3.8.0","3.9.0","4.0","4.0.1","4.0.2","4.1.0","4.1.1","4.10.0","4.10.1","4.11","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.13.0","4.13.0.dev0","4.13.1","4.13.2","4.14.0","4.14.1","4.15.0","4.15.1","4.15.2","4.15.3","4.15.4","4.15.5","4.16.0","4.16.0.dev0","4.17.0","4.18.0","4.18.1","4.2.0","4.3.2","4.3.3","4.4.0","4.4.0b0","4.4.1","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.7.0","4.7.1","4.7.2","4.7.3","4.8.0","4.8.0b0","4.9","4.9.1","4.9.2"]},{"source":"osv","ecosystem":"Root:PyPI","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.1+aikido.1"},{"fixed":"4.18.1+aikido.2"},{"fixed":"4.17.0+aikido.2"},{"fixed":"4.9.2+aikido.2"},{"fixed":"4.16.0+aikido.1"},{"fixed":"4.6.3+aikido.3"},{"fixed":"4.10.1+aikido.1"},{"fixed":"4.10.1+aikido.2"},{"fixed":"4.8.0+aikido.2"},{"fixed":"4.18.0+aikido.2"},{"fixed":"4.9.2+aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-150300.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6-1","2.6.2-1","2.6.3-1","2.6.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3-1","3.2-1","3.2-1build1","3.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-1build2","3.6.1+dfsg1-1","3.6.1+dfsg1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.1-1.1","3.7.1-1.1build1","3.10.1-0ubuntu2","3.10.1-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0-1build2","3.11.0-1build3","3.11.0-1build4","3.11.0-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0-1build6","3.11.0-1build7","3.11.0-1build8","3.11.0-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.16.0-1build1","4.17.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.1-6","4.15.3-1","4.15.3-2","4.15.5-1","4.16.0-1","4.16.0-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-pymongo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-bp160.2.1"}]}],"bundled":3}],"products":[{"vendor":"mongodb","product":"python driver"}],"references":[{"url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj","tags":["advisory","web"]},{"url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2","tags":["web"]},{"url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96748","tags":["web","advisory"]},{"url":"https://github.com/mongodb/mongo-python-driver/pull/3066","tags":["web"]},{"url":"https://github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a","tags":["web"]},{"url":"https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7","tags":["web"]},{"url":"https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vp6j-j7w5-5xjj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96748.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-96748","tags":["advisory"]},{"url":"https://github.com/mongodb/mongo-python-driver","tags":["package"]},{"url":"https://pypi.org/project/pymongo","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264398-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282827","tags":["report"]},{"url":"https://bugzilla.suse.com/1282844","tags":["report"]},{"url":"https://bugzilla.suse.com/1282845","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96749","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-96748","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96748","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-96748","title":"Connection redirection via percent-encoded delimiter injection in connection string hosts","description":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.","status":"published","published":"2026-09-24T18:18:12.032Z","modified":"2026-09-24T19:12:05.362Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-86347","description":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.","status":"published","published":"2026-09-24T18:18:12Z","modified":"2026-09-24T19:12:05Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:56.296478Z"}],"ghsa":[{"id":"GHSA-vp6j-j7w5-5xjj","title":"PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters","description":"### Summary\n\nPyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.\n\n### Impact\n\nAn application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.\n\nUnix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.\n\n### Patches\n\nFixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.\n\n### Workarounds\n\nDo not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.\n\n### Details\n\nThe decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where `unquote_plus` was applied to the whole host section in `_validate_uri` and, later, `_parse_srv`, before the string was split on `,` and `:`.","status":"published","published":"2026-10-05T23:47:07Z","modified":"2026-10-05T23:47:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2026-96748","description":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.","status":"published","published":"2026-09-24T19:17:20.813Z","modified":"2026-09-24T21:00:46.893Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T14:12:51.388161Z"}],"osv":[{"id":"CVE-2026-96748","title":"Connection redirection via percent-encoded delimiter injection in connection string hosts","description":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.","status":"published","published":"2026-09-24T18:18:12.032Z","modified":"2026-10-28T11:09:59.516630395Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T15:45:21.262447Z"},{"id":"DEBIAN-CVE-2026-96748","description":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.","status":"published","published":"2026-09-24T19:17:20.813Z","modified":"2026-10-12T11:00:45.656306559Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"GHSA-vp6j-j7w5-5xjj","title":"PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters","description":"### Summary\n\nPyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.\n\n### Impact\n\nAn application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.\n\nUnix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.\n\n### Patches\n\nFixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.\n\n### Workarounds\n\nDo not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.\n\n### Details\n\nThe decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where `unquote_plus` was applied to the whole host section in `_validate_uri` and, later, `_parse_srv`, before the string was split on `,` and `:`.","status":"published","published":"2026-10-05T23:47:07Z","modified":"2026-10-15T14:56:13.301997054Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-177"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"PYSEC-2026-4297","title":"PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters","description":"### Summary\n\nPyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.\n\n### Impact\n\nAn application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.\n\nUnix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.\n\n### Patches\n\nFixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.\n\n### Workarounds\n\nDo not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.\n\n### Details\n\nThe decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where `unquote_plus` was applied to the whole host section in `_validate_uri` and, later, `_parse_srv`, before the string was split on `,` and `:`.","status":"published","published":"2026-10-15T10:22:46.035003Z","modified":"2026-10-15T14:45:14.721529972Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"UBUNTU-CVE-2026-96748","description":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.","status":"published","published":"2026-09-24T19:17:00Z","modified":"2026-10-17T13:01:20.049268437Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"AZL-105107","title":"CVE-2026-96748 affecting package python-pymongo 4.2.0-9","description":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.","status":"published","published":"2026-09-24T19:17:20Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"CLSA-2026-1792396649","title":"TuxCare security update for pymongo (2 CVEs)","description":"TuxCare rebuilt pymongo to address 2 CVEs. Fixed in 3.13.0.post2+tuxcare.","status":"published","published":"2026-10-19T07:57:29Z","modified":"2026-10-19T13:30:08.108243288Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"openSUSE-SU-2026:11935-1","title":"python313-pymongo-4.18.2-1.1 on GA media","description":"These are all security issues fixed in the python313-pymongo-4.18.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-30T00:00:00Z","modified":"2026-10-01T11:15:05.947097531Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22003-1","title":"Security update for python-pymongo","description":"This update for python-pymongo fixes the following issues:\n\nChanges in python-pymongo:\n\n- CVE-2026-96749: integer overflow in BSON document encoding allows an\n  unprivileged user to write outside the bounds of an allocated buffer\n  (bsc#1282845)\n- CVE-2026-96748: host injection in connection string leading to\n  database connection redirection due to improper connection string\n  parsing (bsc#1282827)\n- CVE-2026-96747: improper handling of key management endpoint values\n  ending in `.sock` allows users with write access to the encryption\n  key metadata to open connections to local sockets on the application\n  host (bsc#1282844)\n","status":"published","published":"2026-09-29T16:36:21Z","modified":"2026-10-01T18:23:10.973972697Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-PYPI-CVE-2026-96748","title":"CVE-2026-96748 in pymongo - Patched by Root","description":"Root has patched CVE-2026-96748 in the pymongo package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-05T10:41:54Z","modified":"2026-11-05T11:15:07.273311695Z","updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"SUSE-SU-2026:4398-1","title":"Security update for python-pymongo","description":"This update for python-pymongo fixes the following issues:\n\n- CVE-2026-96747: improper handling of key management endpoint values ending in `.sock` allows users with write access\n  to the encryption key metadata to open connections to local sockets on the application host (bsc#1282844).\n- CVE-2026-96748: host injection in connection string leading to database connection redirection due to improper\n  connection string parsing (bsc#1282827).\n- CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside the bounds of\n  an allocated buffer (bsc#1282845).\n","status":"published","published":"2026-09-29T16:18:54Z","modified":"2026-09-30T12:00:04.5984393Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}