Java Driver
Monthly
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
Cleartext credential logging in the MongoDB Java Driver exposes outbound network connectivity credentials to any party with log read access during routine client initialization. Affected applications automatically write the credential to log output as part of normal operation - no special trigger, elevated privileges, or attacker interaction with the driver is required to produce the disclosure. While no public exploit or active exploitation has been confirmed, the CVSS 4.0 score of 8.2 reflects that recovered credentials can authenticate an attacker to separate network infrastructure beyond the affected application, producing a scope-changed confidentiality impact.
Command injection in the BSON encoding path of the MongoDB Java Driver lets an application that wraps externally supplied, untrusted bytes in a raw BSON document emit a structurally inconsistent command, so the database can interpret attacker-supplied trailing content as additional fields of the surrounding command and alter the data read or written under the application's credentials. All versions covered by the cpe:2.3:a:mongodb:java_driver wildcard are affected, and the vendor fixed the issue in the 5.14.0 release dated October 28, 2026. Severity is medium (CVSS 4.0 base 6.9; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N): no authentication to the driver or database and no user interaction are required beyond the ability to influence those bytes, but exposure is confined to the non-default pattern of building commands from untrusted raw documents, applications using typed or validated documents are not exposed, and no public exploit has been identified at time of analysis.
NoSQL injection in the GridFS component of the MongoDB Java Driver allows an authenticated low-privilege user who can influence the file identifier passed by an affected application to break out of the intended document scope. By supplying a structured identifier containing MongoDB query operators instead of a literal file ID, the attacker can read file chunks belonging to other owners, delete all file chunks in the affected GridFS bucket (rendering stored content permanently unreadable), or rename an arbitrary stored file rather than the intended target. No public exploit code or CISA KEV entry has been identified at time of analysis, and exploitation requires a specific application code pattern that forwards user-controlled input directly to GridFS operations without sanitization.
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
Cleartext credential logging in the MongoDB Java Driver exposes outbound network connectivity credentials to any party with log read access during routine client initialization. Affected applications automatically write the credential to log output as part of normal operation - no special trigger, elevated privileges, or attacker interaction with the driver is required to produce the disclosure. While no public exploit or active exploitation has been confirmed, the CVSS 4.0 score of 8.2 reflects that recovered credentials can authenticate an attacker to separate network infrastructure beyond the affected application, producing a scope-changed confidentiality impact.
Command injection in the BSON encoding path of the MongoDB Java Driver lets an application that wraps externally supplied, untrusted bytes in a raw BSON document emit a structurally inconsistent command, so the database can interpret attacker-supplied trailing content as additional fields of the surrounding command and alter the data read or written under the application's credentials. All versions covered by the cpe:2.3:a:mongodb:java_driver wildcard are affected, and the vendor fixed the issue in the 5.14.0 release dated October 28, 2026. Severity is medium (CVSS 4.0 base 6.9; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N): no authentication to the driver or database and no user interaction are required beyond the ability to influence those bytes, but exposure is confined to the non-default pattern of building commands from untrusted raw documents, applications using typed or validated documents are not exposed, and no public exploit has been identified at time of analysis.
NoSQL injection in the GridFS component of the MongoDB Java Driver allows an authenticated low-privilege user who can influence the file identifier passed by an affected application to break out of the intended document scope. By supplying a structured identifier containing MongoDB query operators instead of a literal file ID, the attacker can read file chunks belonging to other owners, delete all file chunks in the affected GridFS bucket (rendering stored content permanently unreadable), or rename an arbitrary stored file rather than the intended target. No public exploit code or CISA KEV entry has been identified at time of analysis, and exploitation requires a specific application code pattern that forwards user-controlled input directly to GridFS operations without sanitization.
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required.