C Driver
Monthly
Heap out-of-bounds write in the MongoDB C Driver (libmongoc) allows an unauthenticated attacker who controls DNS resolution and the responses of hosts in a client's connection string to corrupt memory and crash the application. Exploitation requires a privileged network position (MITM or rogue server) and results in denial of service, not code execution or data disclosure. Patched versions 1.30.12 and 2.5.5 are available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver on Windows TLS-backend builds allows the endpoint a client connects to - or an attacker able to impersonate, redirect, or man-in-the-middle that connection - to write attacker-supplied data outside the bounds of a heap allocation while the driver processes incoming encrypted traffic, causing memory corruption, disclosure of adjacent heap memory, or termination of the client process. The flaw is reachable before any application-level authentication completes, so no credentials or user interaction are needed (CVSS PR:N/UI:N), and the vendor rates it 9.2 under CVSS 4.0; however, our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the real gating factors - this is a client-side defect that only fires when the driver connects to an attacker-controlled endpoint or when the attacker can intercept or redirect the connection (AC:H, AT:P), and only in builds compiled against the Windows platform TLS backend. All C Driver releases in the affected ranges (1.24.0 through the 2.4.0 series per ENISA EUVD) are in scope, tracked as CDRIVER-6417; no public exploit code was identified at time of analysis.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
MongoDB C Driver can store or use incorrect numeric values when parsing over-precision Decimal128 strings that contain leading zeros and should have been rejected. The issue affects applications built on the driver that parse attacker-controlled decimal strings, including via Extended JSON, and is limited to data integrity (C:N/I:L/A:N) with no public exploit identified at time of analysis; exploitation requires the embedding application to accept external decimal input. This is a low-to-moderate priority issue rather than a high-urgency flaw.
Out-of-bounds memory access in the MongoDB C Driver can be induced when an embedding C/C++ application passes a length smaller than the five-byte BSON document minimum to bson_reserve_buffer and then performs an affected append or comparison operation, causing unsigned integer underflow and out-of-bounds access that may terminate the process or read or corrupt adjacent memory. Exploitation is not possible against the library in isolation or default usage: the application must forward an undersized, potentially attacker-influenced length into the reservation call and later exercise an affected operation. No public exploit identified at time of analysis; vendor CVSS 4.0 score is 5.9 with AV:L/AT:P/PR:N, and the independent assessment rates it moderate-severity and condition-dependent.
MongoDB C Driver contains an off-by-one heap write in its BSON bulk document writer that can corrupt adjacent memory or crash the process when a serialized document ends at a precise buffer boundary. This medium-severity (CVSS 4.0 base 5.9) issue requires an embedding application to use the BSON bulk-writer API and an attacker to influence document sizes to hit that exact cumulative boundary; the local, unauthenticated attack is difficult to trigger and writes only a single zero byte, so the realistic impact is process termination or limited heap corruption rather than code execution. No public exploit code or active exploitation has been identified at the time of analysis.
Denial of service in the MongoDB C Driver affects any application that uses the driver with SCRAM authentication, because a malformed SCRAM server-final message is parsed with a one-byte out-of-bounds read that can terminate the client process. The attacker must either operate the MongoDB server the client connects to or position themselves as a network intermediary inside the authentication handshake, since the bad message has to arrive before server-signature verification completes; unauthenticated remote delivery is possible under those conditions (CVSS:4.0 PR:N/UI:N, AT:P) but no client privileges or user interaction are required. Impact is limited to availability (VC:N/VI:N/VA:L) and the over-read byte is never returned through the protocol, so there is no data exposure; this is rated medium severity (CVSS 6.3 as published, 3.7 under our assessed CVSS:3.1/AV:N/AC:H vector), with no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis.
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.
SCRAM authentication in the MongoDB C Driver (libmongoc) fails to abort when a nonce mismatch is detected in the server's first message, so the client continues the handshake and still transmits its client proof. An unauthenticated, on-path attacker who can inject a crafted server-first message containing an attacker-controlled salt and a low iteration count on a plaintext connection can capture that proof and brute-force the password offline. The flaw affects C Driver 2.0.0 through versions before 2.3.2, and the vendor explicitly notes TLS mitigates it, so standard TLS-protected production deployments are not exploitable; no public exploit code was identified at time of analysis. The vendor/ENISA CVSS 4.0 base score is 6.3, while our independent assessment (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) rates real-world risk moderate-to-low because exploitation requires both a man-in-the-middle position and an unencrypted or TLS-stripped MongoDB connection, and the payoff is only a captured proof that must still be cracked.
GridFS NoSQL injection in the MongoDB C Driver (libmongoc) enables authenticated users with influence over file identifier parameters to either access file content beyond their intended authorization or destroy all GridFS file chunks in the affected bucket, rendering stored data permanently unreadable. The root cause (CWE-943) is the driver's failure to distinguish between structured query operators and literal identifier values in GridFS operations, allowing attacker-controlled input to redirect or broaden MongoDB queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity and availability sub-scores in the CVSS 4.0 vector indicate genuinely severe outcomes in vulnerable deployments.
Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.
Numeric truncation in the MongoDB C++ Driver's BSON library JSON parsing interface allows an attacker who controls text fed to that interface to read process memory beyond the input buffer, cause silent acceptance of a truncated document fragment as complete, or terminate the host process. Affected systems are any C++ applications embedding the driver that parse externally-controlled JSON; MongoDB server connectivity, credentials, and non-default configuration are explicitly not required. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects both the constraint of requiring very large input documents and the local library-consumer trust boundary.
Heap buffer out-of-bounds write in the MongoDB C Driver's BSON-to-JSON conversion helpers allows an unauthenticated party who supplies document content to corrupt a small number of bytes past the end of a heap-allocated buffer. The overflow is triggered specifically when a binary BSON field is being encoded and the caller has configured a maximum output length that causes the conversion to be cut short. Impact is limited to a low-integrity write of a few bytes adjacent to the buffer - no confidentiality loss and no confirmed availability impact - but heap corruption in native C applications can have unpredictable downstream effects depending on allocator layout. No public exploit code and no CISA KEV listing exist at time of analysis.
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cause applications to silently store truncated or dropped numeric fields. CWE-681 (incorrect conversion between numeric types) triggers when an oversized text-encoded numeric value is parsed: the driver returns a success result while the resulting BSON silently shortens or omits the field entirely. Applications depending on this library for accurate numeric representation - without independent input validation - may persist corrupt data without any indication of failure, creating exploitable logical inconsistencies. No public exploit code or active exploitation has been identified at time of analysis.
Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a sufficiently large JSON document to crash any linked application on 32-bit-size builds. The overflow produces an undersized heap allocation that is freed, while a subsequent copy operation continues writing through the now-dangling pointer - a use-after-free sequence that terminates the host process. No public exploit code or active exploitation has been identified; impact is confined to denial of service, and the attack is constrained to 32-bit size builds of the library.
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are reproduced in plaintext within the driver's diagnostic string representation of its client settings, rather than being masked like other secret fields. Any party with read access to application logs, diagnostic output, or process memory dumps can recover these credentials and independently invoke the key management service to unwrap data-encryption keys, compromising all data protected by those keys. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis; exploitation is bounded by the requirement that CSFLE be configured and that the attacker have access to diagnostic output.
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged attackers to inject MongoDB query-language operators into database operations. The driver omits the element-name and shape validation applied by other write paths, so untrusted loosely-typed input (BsonDocument, Dictionary, dynamic) is forwarded to the MongoDB server unfiltered, enabling attacker-controlled data to be interpreted as update logic under the application's own database credentials. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is bounded to applications that use loosely-typed replacement patterns rather than strongly-typed C# document mappings.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing a '.' separator or NUL byte to redirect a MongoDB operation to an unintended resource. Applications that incorporate unsanitized user input into these name components are affected across all libmongoc versions prior to 2.5.1. No public exploit has been identified at time of analysis; the vendor released a validated fix in version 2.5.1.
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabling crafted documents stored in a GridFS collection to trigger either a division-by-zero crash (denial of service) or an out-of-bounds read that exposes process memory contents to the caller. Versions in the 1.x branch before 1.30.8 and 2.x branch before 2.2.4 are affected per EUVD-2026-31132. The CVSS 4.0 score of 6.0 accurately reflects a constrained attack path requiring low-privilege database access and a pre-positioned malicious document (AT:P), with no public exploit identified at time of analysis.
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation, allowing malformed or invalid UTF-8 sequences in BSON data to bypass validation checks. This affects MongoDB C Driver versions prior to 1.30.5, 2.0.0, and 2.0.1, and impacts applications that depend on this validation function to process untrusted BSON data. Authenticated remote attackers can exploit this to inject invalid BSON data, potentially causing integrity issues in downstream processing; EPSS 0.48 indicates this is a moderate-priority issue that warrants patching but is not among the highest-risk vulnerabilities.
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Heap out-of-bounds write in the MongoDB C Driver (libmongoc) allows an unauthenticated attacker who controls DNS resolution and the responses of hosts in a client's connection string to corrupt memory and crash the application. Exploitation requires a privileged network position (MITM or rogue server) and results in denial of service, not code execution or data disclosure. Patched versions 1.30.12 and 2.5.5 are available; no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver on Windows TLS-backend builds allows the endpoint a client connects to - or an attacker able to impersonate, redirect, or man-in-the-middle that connection - to write attacker-supplied data outside the bounds of a heap allocation while the driver processes incoming encrypted traffic, causing memory corruption, disclosure of adjacent heap memory, or termination of the client process. The flaw is reachable before any application-level authentication completes, so no credentials or user interaction are needed (CVSS PR:N/UI:N), and the vendor rates it 9.2 under CVSS 4.0; however, our assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the real gating factors - this is a client-side defect that only fires when the driver connects to an attacker-controlled endpoint or when the attacker can intercept or redirect the connection (AC:H, AT:P), and only in builds compiled against the Windows platform TLS backend. All C Driver releases in the affected ranges (1.24.0 through the 2.4.0 series per ENISA EUVD) are in scope, tracked as CDRIVER-6417; no public exploit code was identified at time of analysis.
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a trusted TLS endpoint to crash the connecting client application. During the TLS handshake, a server already trusted by the client can present specially crafted certificate data that triggers a heap object being freed twice (CWE-415), causing the client process to terminate unexpectedly. The impact is a client-side denial of service; no code execution has been claimed, and the CVSS 4.0 vector (VA:H, VC:N, VI:N) corroborates an availability-only outcome with no public exploit identified at time of analysis.
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress security-relevant MongoDB connection settings by embedding URL delimiter characters in user-supplied input. When an application passes untrusted text into the driver's connection-URL builder and the resulting string is re-parsed as authoritative client configuration, the injected delimiters are treated as structural URL syntax rather than literal data - allowing options such as TLS mode or authentication parameters to be overridden. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as version 3.11.1 on NuGet.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
MongoDB C Driver can store or use incorrect numeric values when parsing over-precision Decimal128 strings that contain leading zeros and should have been rejected. The issue affects applications built on the driver that parse attacker-controlled decimal strings, including via Extended JSON, and is limited to data integrity (C:N/I:L/A:N) with no public exploit identified at time of analysis; exploitation requires the embedding application to accept external decimal input. This is a low-to-moderate priority issue rather than a high-urgency flaw.
Out-of-bounds memory access in the MongoDB C Driver can be induced when an embedding C/C++ application passes a length smaller than the five-byte BSON document minimum to bson_reserve_buffer and then performs an affected append or comparison operation, causing unsigned integer underflow and out-of-bounds access that may terminate the process or read or corrupt adjacent memory. Exploitation is not possible against the library in isolation or default usage: the application must forward an undersized, potentially attacker-influenced length into the reservation call and later exercise an affected operation. No public exploit identified at time of analysis; vendor CVSS 4.0 score is 5.9 with AV:L/AT:P/PR:N, and the independent assessment rates it moderate-severity and condition-dependent.
MongoDB C Driver contains an off-by-one heap write in its BSON bulk document writer that can corrupt adjacent memory or crash the process when a serialized document ends at a precise buffer boundary. This medium-severity (CVSS 4.0 base 5.9) issue requires an embedding application to use the BSON bulk-writer API and an attacker to influence document sizes to hit that exact cumulative boundary; the local, unauthenticated attack is difficult to trigger and writes only a single zero byte, so the realistic impact is process termination or limited heap corruption rather than code execution. No public exploit code or active exploitation has been identified at the time of analysis.
Denial of service in the MongoDB C Driver affects any application that uses the driver with SCRAM authentication, because a malformed SCRAM server-final message is parsed with a one-byte out-of-bounds read that can terminate the client process. The attacker must either operate the MongoDB server the client connects to or position themselves as a network intermediary inside the authentication handshake, since the bad message has to arrive before server-signature verification completes; unauthenticated remote delivery is possible under those conditions (CVSS:4.0 PR:N/UI:N, AT:P) but no client privileges or user interaction are required. Impact is limited to availability (VC:N/VI:N/VA:L) and the over-read byte is never returned through the protocol, so there is no data exposure; this is rated medium severity (CVSS 6.3 as published, 3.7 under our assessed CVSS:3.1/AV:N/AC:H vector), with no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis.
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input with a zero document-length field, which causes an integer underflow (CWE-191) and a heap out-of-bounds read that crashes the process. The CVSS v4.0 vector indicates remote, unauthenticated exploitation (AV:N/PR:N/UI:N), but the vulnerability only affects code paths that pass untrusted BSON to bson_new_from_buffer(), and impact is limited to a process crash with no data disclosure or code execution. No public exploit code or active exploitation (CISA KEV) was identified in the provided intelligence.
SCRAM authentication in the MongoDB C Driver (libmongoc) fails to abort when a nonce mismatch is detected in the server's first message, so the client continues the handshake and still transmits its client proof. An unauthenticated, on-path attacker who can inject a crafted server-first message containing an attacker-controlled salt and a low iteration count on a plaintext connection can capture that proof and brute-force the password offline. The flaw affects C Driver 2.0.0 through versions before 2.3.2, and the vendor explicitly notes TLS mitigates it, so standard TLS-protected production deployments are not exploitable; no public exploit code was identified at time of analysis. The vendor/ENISA CVSS 4.0 base score is 6.3, while our independent assessment (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) rates real-world risk moderate-to-low because exploitation requires both a man-in-the-middle position and an unencrypted or TLS-stripped MongoDB connection, and the payoff is only a captured proof that must still be cracked.
GridFS NoSQL injection in the MongoDB C Driver (libmongoc) enables authenticated users with influence over file identifier parameters to either access file content beyond their intended authorization or destroy all GridFS file chunks in the affected bucket, rendering stored data permanently unreadable. The root cause (CWE-943) is the driver's failure to distinguish between structured query operators and literal identifier values in GridFS operations, allowing attacker-controlled input to redirect or broaden MongoDB queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity and availability sub-scores in the CVSS 4.0 vector indicate genuinely severe outcomes in vulnerable deployments.
Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.
Numeric truncation in the MongoDB C++ Driver's BSON library JSON parsing interface allows an attacker who controls text fed to that interface to read process memory beyond the input buffer, cause silent acceptance of a truncated document fragment as complete, or terminate the host process. Affected systems are any C++ applications embedding the driver that parse externally-controlled JSON; MongoDB server connectivity, credentials, and non-default configuration are explicitly not required. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects both the constraint of requiring very large input documents and the local library-consumer trust boundary.
Heap buffer out-of-bounds write in the MongoDB C Driver's BSON-to-JSON conversion helpers allows an unauthenticated party who supplies document content to corrupt a small number of bytes past the end of a heap-allocated buffer. The overflow is triggered specifically when a binary BSON field is being encoded and the caller has configured a maximum output length that causes the conversion to be cut short. Impact is limited to a low-integrity write of a few bytes adjacent to the buffer - no confidentiality loss and no confirmed availability impact - but heap corruption in native C applications can have unpredictable downstream effects depending on allocator layout. No public exploit code and no CISA KEV listing exist at time of analysis.
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cause applications to silently store truncated or dropped numeric fields. CWE-681 (incorrect conversion between numeric types) triggers when an oversized text-encoded numeric value is parsed: the driver returns a success result while the resulting BSON silently shortens or omits the field entirely. Applications depending on this library for accurate numeric representation - without independent input validation - may persist corrupt data without any indication of failure, creating exploitable logical inconsistencies. No public exploit code or active exploitation has been identified at time of analysis.
Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a sufficiently large JSON document to crash any linked application on 32-bit-size builds. The overflow produces an undersized heap allocation that is freed, while a subsequent copy operation continues writing through the now-dangling pointer - a use-after-free sequence that terminates the host process. No public exploit code or active exploitation has been identified; impact is confined to denial of service, and the attack is constrained to 32-bit size builds of the library.
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are reproduced in plaintext within the driver's diagnostic string representation of its client settings, rather than being masked like other secret fields. Any party with read access to application logs, diagnostic output, or process memory dumps can recover these credentials and independently invoke the key management service to unwrap data-encryption keys, compromising all data protected by those keys. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis; exploitation is bounded by the requirement that CSFLE be configured and that the attacker have access to diagnostic output.
NoSQL injection in the MongoDB C# Driver's document-replacement code path allows network-accessible, low-privileged attackers to inject MongoDB query-language operators into database operations. The driver omits the element-name and shape validation applied by other write paths, so untrusted loosely-typed input (BsonDocument, Dictionary, dynamic) is forwarded to the MongoDB server unfiltered, enabling attacker-controlled data to be interpreted as update logic under the application's own database credentials. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is bounded to applications that use loosely-typed replacement patterns rather than strongly-typed C# document mappings.
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthenticated attackers to manipulate database queries by embedding special elements in application-supplied values. Affected applications using LINQ query constructs that incorporate user-controlled input fail to properly escape those values before transmission to MongoDB, enabling query logic injection. The CVSS 4.0 score of 6.9 (AV:N/AC:L/PR:N/UI:N) reflects broad reachability with limited but real data confidentiality and integrity impact; no public exploit or CISA KEV listing is identified at time of analysis.
Namespace injection in MongoDB C Driver (libmongoc) allows any caller-controlled database or collection name containing a '.' separator or NUL byte to redirect a MongoDB operation to an unintended resource. Applications that incorporate unsanitized user input into these name components are affected across all libmongoc versions prior to 2.5.1. No public exploit has been identified at time of analysis; the vendor released a validated fix in version 2.5.1.
The legacy GridFS API in the MongoDB C Driver fails to validate file metadata fields retrieved from the database, enabling crafted documents stored in a GridFS collection to trigger either a division-by-zero crash (denial of service) or an out-of-bounds read that exposes process memory contents to the caller. Versions in the 1.x branch before 1.30.8 and 2.x branch before 2.2.4 are affected per EUVD-2026-31132. The CVSS 4.0 score of 6.0 accurately reflects a constrained attack path requiring low-privilege database access and a pre-positioned malicious document (AT:P), with no public exploit identified at time of analysis.
MongoDB C Driver bson_validate function returns early on specific inputs and incorrectly reports successful validation, allowing malformed or invalid UTF-8 sequences in BSON data to bypass validation checks. This affects MongoDB C Driver versions prior to 1.30.5, 2.0.0, and 2.0.1, and impacts applications that depend on this validation function to process untrusted BSON data. Authenticated remote attackers can exploit this to inject invalid BSON data, potentially causing integrity issues in downstream processing; EPSS 0.48 indicates this is a moderate-priority issue that warrants patching but is not among the highest-risk vulnerabilities.
A mongoc_bulk_operation_t may read invalid memory if large options are passed. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Specific versions of the MongoDB C# Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.