Vulnerability-Lookup

WID-SEC-W-2026-3209

Vulnerability from csaf_certbund - Published: 2026-09-06 22:00 - Updated: 2026-09-07 22:00

Summary

MongoDB: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: MongoDB ist ein Open-Source-Dokumentendatenbank.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service zu verursachen, Daten zu manipulieren, Informationen offenzulegen oder beliebige Befehle über die MongoDB-Erweiterung für Visual Studio Code auszuführen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-84962

Affected products

Known affected 8 products

Product	Identifier	Version
Open Source MongoDB C++ Driver <4.5.2 Open Source / MongoDB		C++ Driver <4.5.2
Open Source MongoDB libmongocrypt <1.20.2 Open Source / MongoDB		libmongocrypt <1.20.2
Open Source MongoDB PHP Driver <1.21.8 Open Source / MongoDB		PHP Driver <1.21.8
Open Source MongoDB C Driver <2.5.2 Open Source / MongoDB		C Driver <2.5.2
Open Source MongoDB for VS Code <1.17.1 Open Source / MongoDB		for VS Code <1.17.1
Open Source MongoDB C Driver <1.30.9 Open Source / MongoDB		C Driver <1.30.9
Open Source MongoDB PHP Driver <2.5.1 Open Source / MongoDB		PHP Driver <2.5.1
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—

CVE-2026-84963

Affected products

Known affected 8 products, the same list as for CVE-2026-84962

CVE-2026-84964

Affected products

Known affected 8 products, the same list as for CVE-2026-84962

CVE-2026-84965

Affected products

Known affected 8 products, the same list as for CVE-2026-84962

CVE-2026-84966

Affected products

Known affected 8 products, the same list as for CVE-2026-84962

CVE-2026-84967

Affected products

Known affected 8 products, the same list as for CVE-2026-84962

CVE-2026-84968

Affected products

Known affected 8 products, the same list as for CVE-2026-84962

References

14 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://jira.mongodb.org/browse/CDRIVER-6405	external
https://jira.mongodb.org/browse/CDRIVER-6407	external
https://jira.mongodb.org/browse/CDRIVER-6409	external
https://jira.mongodb.org/browse/CXX-3548	external
https://jira.mongodb.org/browse/MONGOCRYPT-960	external
https://jira.mongodb.org/browse/PHPC-2744	external
https://jira.mongodb.org/browse/VSCODE-798	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "MongoDB ist ein Open-Source-Dokumentendatenbank.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um einen Denial of Service zu verursachen, Daten zu manipulieren, Informationen offenzulegen oder beliebige Befehle \u00fcber die MongoDB-Erweiterung f\u00fcr Visual Studio Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-3209 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3209.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-3209 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3209"
      },
      {
        "category": "external",
        "summary": "MongoDB Jira Ticket CDRIVER-6405 vom 2026-09-06",
        "url": "https://jira.mongodb.org/browse/CDRIVER-6405"
      },
      {
        "category": "external",
        "summary": "MongoDB Jira Ticket CDRIVER-6407 vom 2026-09-06",
        "url": "https://jira.mongodb.org/browse/CDRIVER-6407"
      },
      {
        "category": "external",
        "summary": "MongoDB Jira Ticket CDRIVER-6409 vom 2026-09-06",
        "url": "https://jira.mongodb.org/browse/CDRIVER-6409"
      },
      {
        "category": "external",
        "summary": "MongoDB Jira Ticket CXX-3548 vom 2026-09-06",
        "url": "https://jira.mongodb.org/browse/CXX-3548"
      },
      {
        "category": "external",
        "summary": "MongoDB Jira Ticket MONGOCRYPT-960 vom 2026-09-06",
        "url": "https://jira.mongodb.org/browse/MONGOCRYPT-960"
      },
      {
        "category": "external",
        "summary": "MongoDB Jira Ticket PHPC-2744 vom 2026-09-06",
        "url": "https://jira.mongodb.org/browse/PHPC-2744"
      },
      {
        "category": "external",
        "summary": "MongoDB Jira Ticket VSCODE-798 vom 2026-09-06",
        "url": "https://jira.mongodb.org/browse/VSCODE-798"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-358D3CCDFE vom 2026-09-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-358d3ccdfe"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-7D7AC5F0F9 vom 2026-09-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7d7ac5f0f9"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-99AC8D2816 vom 2026-09-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-99ac8d2816"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-CAF49A7828 vom 2026-09-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-caf49a7828"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-D6AEFC999F vom 2026-09-08",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d6aefc999f"
      }
    ],
    "source_lang": "en-US",
    "title": "MongoDB: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-09-07T22:00:00.000+00:00",
      "generator": {
        "date": "2026-09-08T08:44:21.456+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-3209",
      "initial_release_date": "2026-09-06T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-09-06T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-09-07T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Fedora aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74178",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "C Driver \u003c1.30.9",
                "product": {
                  "name": "Open Source MongoDB C Driver \u003c1.30.9",
                  "product_id": "T059044"
                }
              },
              {
                "category": "product_version",
                "name": "C Driver 1.30.9",
                "product": {
                  "name": "Open Source MongoDB C Driver 1.30.9",
                  "product_id": "T059044-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:c_driver__1.30.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "C Driver \u003c2.5.2",
                "product": {
                  "name": "Open Source MongoDB C Driver \u003c2.5.2",
                  "product_id": "T059045"
                }
              },
              {
                "category": "product_version",
                "name": "C Driver 2.5.2",
                "product": {
                  "name": "Open Source MongoDB C Driver 2.5.2",
                  "product_id": "T059045-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:c_driver__2.5.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "C++ Driver \u003c4.5.2",
                "product": {
                  "name": "Open Source MongoDB C++ Driver \u003c4.5.2",
                  "product_id": "T059083"
                }
              },
              {
                "category": "product_version",
                "name": "C++ Driver 4.5.2",
                "product": {
                  "name": "Open Source MongoDB C++ Driver 4.5.2",
                  "product_id": "T059083-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:c_driver__4.5.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "libmongocrypt \u003c1.20.2",
                "product": {
                  "name": "Open Source MongoDB libmongocrypt \u003c1.20.2",
                  "product_id": "T059084"
                }
              },
              {
                "category": "product_version",
                "name": "libmongocrypt 1.20.2",
                "product": {
                  "name": "Open Source MongoDB libmongocrypt 1.20.2",
                  "product_id": "T059084-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:libmongocrypt__1.20.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Driver \u003c1.21.8",
                "product": {
                  "name": "Open Source MongoDB PHP Driver \u003c1.21.8",
                  "product_id": "T059087"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Driver 1.21.8",
                "product": {
                  "name": "Open Source MongoDB PHP Driver 1.21.8",
                  "product_id": "T059087-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_driver__1.21.8"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Driver \u003c2.5.1",
                "product": {
                  "name": "Open Source MongoDB PHP Driver \u003c2.5.1",
                  "product_id": "T059088"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Driver 2.5.1",
                "product": {
                  "name": "Open Source MongoDB PHP Driver 2.5.1",
                  "product_id": "T059088-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_driver__2.5.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "for VS Code \u003c1.17.1",
                "product": {
                  "name": "Open Source MongoDB for VS Code \u003c1.17.1",
                  "product_id": "T059089"
                }
              },
              {
                "category": "product_version",
                "name": "for VS Code 1.17.1",
                "product": {
                  "name": "Open Source MongoDB for VS Code 1.17.1",
                  "product_id": "T059089-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:for_vs_code__1.17.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MongoDB"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-84962",
      "product_status": {
        "known_affected": [
          "T059083",
          "T059084",
          "T059087",
          "T059045",
          "T059089",
          "T059044",
          "T059088",
          "74178"
        ]
      },
      "release_date": "2026-09-06T22:00:00.000+00:00",
      "title": "CVE-2026-84962"
    },
    {
      "cve": "CVE-2026-84963",
      "product_status": {
        "known_affected": [
          "T059083",
          "T059084",
          "T059087",
          "T059045",
          "T059089",
          "T059044",
          "T059088",
          "74178"
        ]
      },
      "release_date": "2026-09-06T22:00:00.000+00:00",
      "title": "CVE-2026-84963"
    },
    {
      "cve": "CVE-2026-84964",
      "product_status": {
        "known_affected": [
          "T059083",
          "T059084",
          "T059087",
          "T059045",
          "T059089",
          "T059044",
          "T059088",
          "74178"
        ]
      },
      "release_date": "2026-09-06T22:00:00.000+00:00",
      "title": "CVE-2026-84964"
    },
    {
      "cve": "CVE-2026-84965",
      "product_status": {
        "known_affected": [
          "T059083",
          "T059084",
          "T059087",
          "T059045",
          "T059089",
          "T059044",
          "T059088",
          "74178"
        ]
      },
      "release_date": "2026-09-06T22:00:00.000+00:00",
      "title": "CVE-2026-84965"
    },
    {
      "cve": "CVE-2026-84966",
      "product_status": {
        "known_affected": [
          "T059083",
          "T059084",
          "T059087",
          "T059045",
          "T059089",
          "T059044",
          "T059088",
          "74178"
        ]
      },
      "release_date": "2026-09-06T22:00:00.000+00:00",
      "title": "CVE-2026-84966"
    },
    {
      "cve": "CVE-2026-84967",
      "product_status": {
        "known_affected": [
          "T059083",
          "T059084",
          "T059087",
          "T059045",
          "T059089",
          "T059044",
          "T059088",
          "74178"
        ]
      },
      "release_date": "2026-09-06T22:00:00.000+00:00",
      "title": "CVE-2026-84967"
    },
    {
      "cve": "CVE-2026-84968",
      "product_status": {
        "known_affected": [
          "T059083",
          "T059084",
          "T059087",
          "T059045",
          "T059089",
          "T059044",
          "T059088",
          "74178"
        ]
      },
      "release_date": "2026-09-06T22:00:00.000+00:00",
      "title": "CVE-2026-84968"
    }
  ]
}

CVE-2026-84962 (GCVE-0-2026-84962)

Vulnerability from cvelistv5 – Published: 2026-09-03 15:03 – Updated: 2026-09-03 15:34

Title

Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

Summary

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

Severity

5.7 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 15:32 UTC

CWE

CWE-93

Assigner

mongodb mitre root Scorecard

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/MONGOCRYPT-960

Impacted products

1 product

Vendor	Product	Version
MongoDB	libmongocrypt	Affected: 0 , < 1.20.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84962",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:32:38.247701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:34:35.133Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.20.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user\u0027s identity, escalating database-level access into cloud key control and defeating client-side encryption."
            }
          ],
          "value": "An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user\u0027s identity, escalating database-level access into cloud key control and defeating client-side encryption."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:03:52.811Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-960"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Authenticated KMS request forgery via CRLF injection in GCP key identifier strings",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84962",
    "datePublished": "2026-09-03T15:03:52.811Z",
    "dateReserved": "2026-09-02T17:58:52.742Z",
    "dateUpdated": "2026-09-03T15:34:35.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84963 (GCVE-0-2026-84963)

Vulnerability from cvelistv5 – Published: 2026-09-03 15:03 – Updated: 2026-09-03 15:35

Title

Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser

Summary

An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 15:35 UTC

CWE

CWE-681 - Incorrect Conversion between Numeric Types

Assigner

mongodb mitre root Scorecard

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/CDRIVER-6407

Impacted products

1 product

Vendor	Product	Version
MongoDB	C Driver	Affected: 1.10.0 , < 1.30.9 (semver) Affected: 2.0.0 , < 2.5.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84963",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:35:10.846682Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:35:27.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.30.9",
              "status": "affected",
              "version": "1.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.5.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver\u0027s BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data."
            }
          ],
          "value": "An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver\u0027s BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-681",
              "description": "CWE-681: Incorrect Conversion between Numeric Types",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:03:13.274Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CDRIVER-6407"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84963",
    "datePublished": "2026-09-03T15:03:13.274Z",
    "dateReserved": "2026-09-02T17:58:52.742Z",
    "dateUpdated": "2026-09-03T15:35:27.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84964 (GCVE-0-2026-84964)

Vulnerability from cvelistv5 – Published: 2026-09-03 15:02 – Updated: 2026-09-03 15:42

Title

Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client

Summary

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 15:41 UTC

CWE

CWE-415 - Double Free

Assigner

mongodb mitre root Scorecard

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/CDRIVER-6409

Impacted products

1 product

Vendor	Product	Version
MongoDB	C Driver	Affected: 1.17.0 , < 1.30.9 (semver) Affected: 2.0.0 , < 2.5.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84964",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:41:47.363270Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:42:32.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.30.9",
              "status": "affected",
              "version": "1.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.5.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly."
            }
          ],
          "value": "A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415: Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:02:20.836Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CDRIVER-6409"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84964",
    "datePublished": "2026-09-03T15:02:20.836Z",
    "dateReserved": "2026-09-02T17:58:52.742Z",
    "dateUpdated": "2026-09-03T15:42:32.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84965 (GCVE-0-2026-84965)

Vulnerability from cvelistv5 – Published: 2026-09-03 15:01 – Updated: 2026-09-03 15:44

Title

Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds

Summary

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 15:43 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mongodb mitre root Scorecard

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/CDRIVER-6405

Impacted products

1 product

Vendor	Product	Version
MongoDB	C Driver	Affected: 1.10.0 , < 1.30.9 (semver) Affected: 2.0.0 , < 2.5.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84965",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:43:02.927377Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:44:49.921Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.30.9",
              "status": "affected",
              "version": "1.10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.5.2",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An integer wraparound in an allocation size calculation in the BSON library\u0027s JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service."
            }
          ],
          "value": "An integer wraparound in an allocation size calculation in the BSON library\u0027s JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:01:21.882Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CDRIVER-6405"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84965",
    "datePublished": "2026-09-03T15:01:21.882Z",
    "dateReserved": "2026-09-02T17:58:52.742Z",
    "dateUpdated": "2026-09-03T15:44:49.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84966 (GCVE-0-2026-84966)

Vulnerability from cvelistv5 – Published: 2026-09-03 15:00 – Updated: 2026-09-03 15:38

Title

BSON element injection via NUL-embedded document keys in builder append

Summary

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 15:38 UTC

CWE

CWE-681 - Incorrect Conversion between Numeric Types

Assigner

mongodb mitre root Scorecard

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/CXX-3548

Impacted products

1 product

Vendor	Product	Version
MongoDB	C++ Driver	Affected: 3.2.0 , < 4.5.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84966",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:38:47.754602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:38:58.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C++ Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "4.5.2",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form."
            }
          ],
          "value": "An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-681",
              "description": "CWE-681: Incorrect Conversion between Numeric Types",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:00:15.517Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/CXX-3548"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "BSON element injection via NUL-embedded document keys in builder append",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84966",
    "datePublished": "2026-09-03T15:00:15.517Z",
    "dateReserved": "2026-09-02T17:58:52.742Z",
    "dateUpdated": "2026-09-03T15:38:58.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84967 (GCVE-0-2026-84967)

Vulnerability from cvelistv5 – Published: 2026-09-03 15:18 – Updated: 2026-09-03 15:30

Title

Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

Summary

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 15:30 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

mongodb mitre root Scorecard

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/VSCODE-798

Impacted products

1 product

Vendor	Product	Version
MongoDB	MongoDB for VS Code	Affected: 1.13.0 , < 1.17.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84967",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:30:45.994921Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:30:54.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MongoDB for VS Code",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.17.1",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension\u0027s shell feature, can place characters of the unauthorized-user\u2019s choosing into that command line. No privileges on the developer\u0027s machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text."
            }
          ],
          "value": "A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension\u0027s shell feature, can place characters of the unauthorized-user\u2019s choosing into that command line. No privileges on the developer\u0027s machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:19:35.290Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/VSCODE-798"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84967",
    "datePublished": "2026-09-03T15:18:02.017Z",
    "dateReserved": "2026-09-02T17:58:52.742Z",
    "dateUpdated": "2026-09-03T15:30:54.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84968 (GCVE-0-2026-84968)

Vulnerability from cvelistv5 – Published: 2026-09-03 17:03 – Updated: 2026-09-04 15:29

Title

Heap out-of-bounds read via corrupt nested BSON in field path error message

Summary

An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-03 17:30 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

mongodb mitre root Scorecard

References

1 reference

URL	Tags
https://jira.mongodb.org/browse/PHPC-2744

Impacted products

1 product

Vendor	Product	Version
MongoDB	PHP Driver	Affected: 1.15.0 , < 1.21.8 (semver) Affected: 2.0.0 , < 2.1.9 (semver) Affected: 2.2.0 , < 2.5.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T17:30:52.642212Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T17:32:29.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PHP Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "1.15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.1.9",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.5.1",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents."
            }
          ],
          "value": "An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T15:29:52.846Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/PHPC-2744"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Heap out-of-bounds read via corrupt nested BSON in field path error message",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84968",
    "datePublished": "2026-09-03T17:03:14.139Z",
    "dateReserved": "2026-09-02T17:58:52.742Z",
    "dateUpdated": "2026-09-04T15:29:52.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2026-3209

CVE-2026-84962 (GCVE-0-2026-84962)

CVE-2026-84963 (GCVE-0-2026-84963)

CVE-2026-84964 (GCVE-0-2026-84964)

CVE-2026-84965 (GCVE-0-2026-84965)

CVE-2026-84966 (GCVE-0-2026-84966)

CVE-2026-84967 (GCVE-0-2026-84967)

CVE-2026-84968 (GCVE-0-2026-84968)

Tags

Sightings

Nomenclature

Related by attack behaviour