Mongodb C Driver vulnerabilities

• mongodb c driver Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver CVE-2026-106438 Fix available 5.1 MediumOctober 8, 2026
• mongodb c driver Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver CVE-2026-106437 Fix available 5.9 MediumOctober 8, 2026
• mongodb c driver Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() CVE-2026-93395 Fix available 6.9 MediumSeptember 17, 2026
• mongodb c driver libmongoc SCRAM client nonce-validation bypass CVE-2026-93394 Fix available 6.3 MediumSeptember 17, 2026
• mongodb c driver Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream CVE-2026-93393 Fix available 9.2 CriticalSeptember 17, 2026
• mongodb c driver GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver CVE-2026-88036 Fix available 6.1 MediumSeptember 10, 2026
• mongodb c driver Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver CVE-2026-88035 Fix available 5.7 MediumSeptember 10, 2026
• mongodb c driver Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser CVE-2026-84963 Fix available 6.3 MediumSeptember 3, 2026
• mongodb c driver Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client CVE-2026-84964 Fix available 8.2 HighSeptember 3, 2026
• mongodb c driver Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds CVE-2026-84965 Fix available 5.9 MediumSeptember 3, 2026
• mongodb c driver Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output CVE-2026-84969 Fix available 6.3 MediumSeptember 3, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values CVE-2026-81533 6.0 MediumAugust 28, 2026
• mongodb bi connector odbc driver BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption CVE-2026-81532 8.7 HighAugust 28, 2026
• mongodb c driver Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver CVE-2026-81524 Fix available 5.3 MediumAugust 27, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings CVE-2026-19003 8.4 HighAugust 12, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters CVE-2026-19004 8.8 HighAugust 12, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data CVE-2026-18888 7.1 HighAugust 12, 2026
• mongodb bi connector odbc driver MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names CVE-2026-19001 9.5 CriticalAugust 12, 2026
• mongodb bi connector odbc driver Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver CVE-2026-19002 8.8 HighAugust 12, 2026
• mongodb atlas sql odbc driver, odbc driver, schema builder cli +1 more +3 more Insufficient OIDC endpoint validation could invoke unintended local protocol handlers CVE-2026-19503 6.3 MediumAugust 12, 2026
• mongodb c driver Heap memory out of bounds read and crash in C Driver legacy GridFS file reader CVE-2026-9100 Fix available 6.0 MediumMay 20, 2026
• mongodb c driver MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow CVE-2026-6691 Fix available 8.6 HighMay 6, 2026
• mongodb c driver bson_validate may skip validation when processing certain inputs CVE-2026-6231 Fix available 5.3 MediumApril 13, 2026
• mongodb c driver Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer CVE-2026-4359 Fix available 2.0 LowMarch 17, 2026
• mongodb c driver, php driver +1 more Bulk write with options may read invalid memory CVE-2025-12119 Fix available 6.9 MediumNovember 18, 2025
• mongodb c driver, mongodb, mongodb php driver +2 more +4 more Accessing Untrusted Directory May Allow Local Privilege Escalation CVE-2024-7553 Fix available 7.3 HighAugust 7, 2024
• mongodb c driver MongoDB client C Driver may infinitely loop when validating certain BSON input data CVE-2023-0437 Fix available 5.3 MediumJanuary 12, 2024
• mongodb c driver, node.js, php driver +4 more +6 more Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application CVE-2021-32050 Fix available 4.2 MediumAugust 29, 2023
• mongodb c driver, whoopsie project whoopsie +1 more bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and... CVE-2020-12135 Fix available 5.5 MediumApril 24, 2020