Vulnerability-Lookup

WID-SEC-W-2026-3583

Vulnerability from csaf_certbund - Published: 2026-09-24 22:00 - Updated: 2026-09-29 22:00

Summary

MongoDB Treiber (Python Driver, PHP Driver, C Driver, Compass und Laravel): Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: MongoDB ist ein Open-Source-Dokumentendatenbank.

Angriff: Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Treibern (Python Driver, PHP Driver, C Driver, Compass und Laravel) ausnutzen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren, um beliebigen Programmcode auszuführen und um einen nicht näher spezifizierten Angriff durchzuführen.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2026-96744

Affected products

Known affected 9 products

Product	Identifier	Version
Open Source MongoDB C Driver <2.5.5 Open Source / MongoDB		C Driver <2.5.5
Open Source MongoDB C Driver <1.30.12 Open Source / MongoDB		C Driver <1.30.12
Open Source MongoDB PHP Driver <2.5.3 Open Source / MongoDB		PHP Driver <2.5.3
Open Source MongoDB PHP Driver <2.1.10 Open Source / MongoDB		PHP Driver <2.1.10
Open Source MongoDB Compass <1.49.12 Open Source / MongoDB		Compass <1.49.12
Open Source MongoDB Laravel <5.11.0 Open Source / MongoDB		Laravel <5.11.0
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
Open Source MongoDB PHP Driver <1.21.10 Open Source / MongoDB		PHP Driver <1.21.10
Open Source MongoDB Python Driver <4.18.2 Open Source / MongoDB		Python Driver <4.18.2

CVE-2026-96745

Affected products

Known affected 9 products, the same list as for CVE-2026-96744

CVE-2026-96746

Affected products

Known affected 9 products, the same list as for CVE-2026-96744

CVE-2026-96747

Affected products

Known affected 9 products, the same list as for CVE-2026-96744

CVE-2026-96748

Affected products

Known affected 9 products, the same list as for CVE-2026-96744

CVE-2026-96749

Affected products

Known affected 9 products, the same list as for CVE-2026-96744

CVE-2026-96750

Affected products

Known affected 9 products, the same list as for CVE-2026-96744

References

10 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/advisories/GHSA-VM72-96WQ-2PPV	external
https://github.com/advisories/GHSA-G679-8JM6-PQF7	external
https://github.com/mongodb/mongo-c-driver/securit…	external
https://github.com/mongodb/mongo-php-driver/secur…	external
https://github.com/mongodb/mongo-python-driver/se…	external
https://github.com/mongodb/mongo-python-driver/se…	external
https://github.com/mongodb/mongo-python-driver/se…	external
https://lists.suse.com/pipermail/sle-security-upd…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "MongoDB ist ein Open-Source-Dokumentendatenbank.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Treibern (Python Driver, PHP Driver, C Driver, Compass und Laravel) ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, um Daten zu manipulieren, um beliebigen Programmcode auszuf\u00fchren und um einen nicht n\u00e4her spezifizierten Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-3583 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3583.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-3583 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3583"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-09-24",
        "url": "https://github.com/advisories/GHSA-VM72-96WQ-2PPV"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-09-24",
        "url": "https://github.com/advisories/GHSA-G679-8JM6-PQF7"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-09-24",
        "url": "https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-09-24",
        "url": "https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-09-24",
        "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-09-24",
        "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2026-09-24",
        "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:4398-1 vom 2026-09-30",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-September/029483.html"
      }
    ],
    "source_lang": "en-US",
    "title": "MongoDB Treiber (Python Driver, PHP Driver, C Driver, Compass und Laravel): Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-09-29T22:00:00.000+00:00",
      "generator": {
        "date": "2026-09-30T10:27:02.947+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-3583",
      "initial_release_date": "2026-09-24T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-09-24T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-09-29T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von SUSE aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Python Driver \u003c4.18.2",
                "product": {
                  "name": "Open Source MongoDB Python Driver \u003c4.18.2",
                  "product_id": "T060213"
                }
              },
              {
                "category": "product_version",
                "name": "Python Driver 4.18.2",
                "product": {
                  "name": "Open Source MongoDB Python Driver 4.18.2",
                  "product_id": "T060213-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:python_driver__4.18.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Driver \u003c1.21.10",
                "product": {
                  "name": "Open Source MongoDB PHP Driver \u003c1.21.10",
                  "product_id": "T060214"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Driver 1.21.10",
                "product": {
                  "name": "Open Source MongoDB PHP Driver 1.21.10",
                  "product_id": "T060214-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_driver__1.21.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Driver \u003c2.1.10",
                "product": {
                  "name": "Open Source MongoDB PHP Driver \u003c2.1.10",
                  "product_id": "T060215"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Driver 2.1.10",
                "product": {
                  "name": "Open Source MongoDB PHP Driver 2.1.10",
                  "product_id": "T060215-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_driver__2.1.10"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "PHP Driver \u003c2.5.3",
                "product": {
                  "name": "Open Source MongoDB PHP Driver \u003c2.5.3",
                  "product_id": "T060216"
                }
              },
              {
                "category": "product_version",
                "name": "PHP Driver 2.5.3",
                "product": {
                  "name": "Open Source MongoDB PHP Driver 2.5.3",
                  "product_id": "T060216-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:php_driver__2.5.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "C Driver \u003c1.30.12",
                "product": {
                  "name": "Open Source MongoDB C Driver \u003c1.30.12",
                  "product_id": "T060217"
                }
              },
              {
                "category": "product_version",
                "name": "C Driver 1.30.12",
                "product": {
                  "name": "Open Source MongoDB C Driver 1.30.12",
                  "product_id": "T060217-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:c_driver__1.30.12"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "C Driver \u003c2.5.5",
                "product": {
                  "name": "Open Source MongoDB C Driver \u003c2.5.5",
                  "product_id": "T060218"
                }
              },
              {
                "category": "product_version",
                "name": "C Driver 2.5.5",
                "product": {
                  "name": "Open Source MongoDB C Driver 2.5.5",
                  "product_id": "T060218-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:c_driver__2.5.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Compass \u003c1.49.12",
                "product": {
                  "name": "Open Source MongoDB Compass \u003c1.49.12",
                  "product_id": "T060219"
                }
              },
              {
                "category": "product_version",
                "name": "Compass 1.49.12",
                "product": {
                  "name": "Open Source MongoDB Compass 1.49.12",
                  "product_id": "T060219-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:compass__1.49.12"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Laravel \u003c5.11.0",
                "product": {
                  "name": "Open Source MongoDB Laravel \u003c5.11.0",
                  "product_id": "T060220"
                }
              },
              {
                "category": "product_version",
                "name": "Laravel 5.11.0",
                "product": {
                  "name": "Open Source MongoDB Laravel 5.11.0",
                  "product_id": "T060220-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mongodb:mongodb:laravel__5.11.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "MongoDB"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T054646",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-96744",
      "product_status": {
        "known_affected": [
          "T060218",
          "T060217",
          "T060216",
          "T060215",
          "T060219",
          "T060220",
          "T054646",
          "T060214",
          "T060213"
        ]
      },
      "release_date": "2026-09-24T22:00:00.000+00:00",
      "title": "CVE-2026-96744"
    },
    {
      "cve": "CVE-2026-96745",
      "product_status": {
        "known_affected": [
          "T060218",
          "T060217",
          "T060216",
          "T060215",
          "T060219",
          "T060220",
          "T054646",
          "T060214",
          "T060213"
        ]
      },
      "release_date": "2026-09-24T22:00:00.000+00:00",
      "title": "CVE-2026-96745"
    },
    {
      "cve": "CVE-2026-96746",
      "product_status": {
        "known_affected": [
          "T060218",
          "T060217",
          "T060216",
          "T060215",
          "T060219",
          "T060220",
          "T054646",
          "T060214",
          "T060213"
        ]
      },
      "release_date": "2026-09-24T22:00:00.000+00:00",
      "title": "CVE-2026-96746"
    },
    {
      "cve": "CVE-2026-96747",
      "product_status": {
        "known_affected": [
          "T060218",
          "T060217",
          "T060216",
          "T060215",
          "T060219",
          "T060220",
          "T054646",
          "T060214",
          "T060213"
        ]
      },
      "release_date": "2026-09-24T22:00:00.000+00:00",
      "title": "CVE-2026-96747"
    },
    {
      "cve": "CVE-2026-96748",
      "product_status": {
        "known_affected": [
          "T060218",
          "T060217",
          "T060216",
          "T060215",
          "T060219",
          "T060220",
          "T054646",
          "T060214",
          "T060213"
        ]
      },
      "release_date": "2026-09-24T22:00:00.000+00:00",
      "title": "CVE-2026-96748"
    },
    {
      "cve": "CVE-2026-96749",
      "product_status": {
        "known_affected": [
          "T060218",
          "T060217",
          "T060216",
          "T060215",
          "T060219",
          "T060220",
          "T054646",
          "T060214",
          "T060213"
        ]
      },
      "release_date": "2026-09-24T22:00:00.000+00:00",
      "title": "CVE-2026-96749"
    },
    {
      "cve": "CVE-2026-96750",
      "product_status": {
        "known_affected": [
          "T060218",
          "T060217",
          "T060216",
          "T060215",
          "T060219",
          "T060220",
          "T054646",
          "T060214",
          "T060213"
        ]
      },
      "release_date": "2026-09-24T22:00:00.000+00:00",
      "title": "CVE-2026-96750"
    }
  ]
}

CVE-2026-96744 (GCVE-0-2026-96744)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:51 – Updated: 2026-09-24 17:08

Title

Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel

Summary

Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 17:07 UTC

CWE

CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

Assigner

mongodb mitre root Scorecard

References

2 references

URL	Tags
https://github.com/mongodb/laravel-mongodb/pull/3579
https://github.com/mongodb/laravel-mongodb/releas…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Laravel MongoDB (PHP)	Affected: 4.3.0 , < 5.11.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T17:07:07.976230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T17:08:59.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Laravel MongoDB (PHP)",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "5.11.0",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations."
            }
          ],
          "value": "Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-943",
              "description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:51:12.113Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/laravel-mongodb/pull/3579"
        },
        {
          "url": "https://github.com/mongodb/laravel-mongodb/releases/tag/5.11.0"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96744",
    "datePublished": "2026-09-24T15:51:12.113Z",
    "dateReserved": "2026-09-23T15:45:48.500Z",
    "dateUpdated": "2026-09-24T17:08:59.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96745 (GCVE-0-2026-96745)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:51 – Updated: 2026-09-24 18:18

Title

PHP object injection via unsuppressible __pclass class inference in command monitoring events

Summary

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

5.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 17:21 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

mongodb mitre root Scorecard

References

5 references

URL	Tags
https://github.com/mongodb/mongo-php-driver/secur…
https://github.com/mongodb/mongo-php-driver/relea…
https://github.com/mongodb/mongo-php-driver/relea…
https://github.com/mongodb/mongo-php-driver/relea…
https://github.com/mongodb/mongo-php-driver/pull/2115

Impacted products

1 product

Vendor	Product	Version
MongoDB	PHP Driver	Affected: 0 , < 1.21.10 (semver) Affected: 2.0.0 , < 2.1.10 (semver) Affected: 2.2.0 , < 2.5.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T17:21:29.694907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T17:22:47.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PHP Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.21.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.1.10",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver\u0027s persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application."
            }
          ],
          "value": "Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver\u0027s persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T18:18:09.854Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c"
        },
        {
          "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.10"
        },
        {
          "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/2.1.10"
        },
        {
          "url": "https://github.com/mongodb/mongo-php-driver/releases/tag/2.5.3"
        },
        {
          "url": "https://github.com/mongodb/mongo-php-driver/pull/2115"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "PHP object injection via unsuppressible __pclass class inference in command monitoring events",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96745",
    "datePublished": "2026-09-24T15:51:16.196Z",
    "dateReserved": "2026-09-23T15:45:49.109Z",
    "dateUpdated": "2026-09-24T18:18:09.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96746 (GCVE-0-2026-96746)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:51 – Updated: 2026-09-24 18:18

Title

Heap buffer overflow via mid-scan command list growth in client topology monitoring

Summary

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 17:10 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

mongodb mitre root Scorecard

References

3 references

URL	Tags
https://github.com/mongodb/mongo-c-driver/securit…
https://github.com/mongodb/mongo-c-driver/release…
https://github.com/mongodb/mongo-c-driver/release…

Impacted products

1 product

Vendor	Product	Version
MongoDB	C Driver	Affected: 0 , < 1.30.12 (semver) Affected: 2.0.0 , < 2.5.5 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T17:10:23.359575Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T17:10:30.886Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "C Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.30.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.5.5",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client\u0027s connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly."
            }
          ],
          "value": "An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client\u0027s connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T18:18:08.886Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46"
        },
        {
          "url": "https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.12"
        },
        {
          "url": "https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.5"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Heap buffer overflow via mid-scan command list growth in client topology monitoring",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96746",
    "datePublished": "2026-09-24T15:51:15.196Z",
    "dateReserved": "2026-09-23T15:45:49.685Z",
    "dateUpdated": "2026-09-24T18:18:08.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96747 (GCVE-0-2026-96747)

Vulnerability from cvelistv5 – Published: 2026-09-24 18:18 – Updated: 2026-09-24 19:12

Title

Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption

Summary

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 18:36 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

mongodb mitre root Scorecard

References

3 references

URL	Tags
https://github.com/mongodb/mongo-python-driver/se…
https://github.com/mongodb/mongo-python-driver/re…
https://github.com/mongodb/mongo-python-driver/bl…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Python Driver	Affected: 3.9.0 , < 4.18.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96747",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T18:36:00.653378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T18:36:09.079Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Python Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "4.18.2",
              "status": "affected",
              "version": "3.9.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in \".sock\" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted."
            }
          ],
          "value": "The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in \".sock\" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T19:12:04.304Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96747",
    "datePublished": "2026-09-24T18:18:10.962Z",
    "dateReserved": "2026-09-23T15:45:50.286Z",
    "dateUpdated": "2026-09-24T19:12:04.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96748 (GCVE-0-2026-96748)

Vulnerability from cvelistv5 – Published: 2026-09-24 18:18 – Updated: 2026-09-24 19:12

Title

Connection redirection via percent-encoded delimiter injection in connection string hosts

Summary

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 18:36 UTC

CWE

CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

Assigner

mongodb mitre root Scorecard

References

3 references

URL	Tags
https://github.com/mongodb/mongo-python-driver/se…
https://github.com/mongodb/mongo-python-driver/re…
https://github.com/mongodb/mongo-python-driver/bl…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Python Driver	Affected: 0 , < 4.18.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T18:36:30.450714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T18:36:36.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Python Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "4.18.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PyMongo\u0027s connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application\u0027s database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results."
            }
          ],
          "value": "PyMongo\u0027s connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application\u0027s database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-177",
              "description": "CWE-177: Improper Handling of URL Encoding (Hex Encoding)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T19:12:05.362Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Connection redirection via percent-encoded delimiter injection in connection string hosts",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96748",
    "datePublished": "2026-09-24T18:18:12.032Z",
    "dateReserved": "2026-09-23T15:45:50.867Z",
    "dateUpdated": "2026-09-24T19:12:05.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96749 (GCVE-0-2026-96749)

Vulnerability from cvelistv5 – Published: 2026-09-24 18:18 – Updated: 2026-09-26 03:55

Title

Heap out-of-bounds write via signed size overflow in BSON document encoding

Summary

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 00:00 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mongodb mitre root Scorecard

References

3 references

URL	Tags
https://github.com/mongodb/mongo-python-driver/se…
https://github.com/mongodb/mongo-python-driver/re…
https://github.com/mongodb/mongo-python-driver/bl…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Python Driver	Affected: 1.9.0 , < 4.18.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96749",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-26T03:55:41.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Python Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "4.18.2",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An integer overflow in the BSON document encoding component of the MongoDB Python Driver\u0027s bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application\u0027s own process."
            }
          ],
          "value": "An integer overflow in the BSON document encoding component of the MongoDB Python Driver\u0027s bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application\u0027s own process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T19:12:06.439Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Heap out-of-bounds write via signed size overflow in BSON document encoding",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96749",
    "datePublished": "2026-09-24T18:18:13.077Z",
    "dateReserved": "2026-09-23T15:45:51.412Z",
    "dateUpdated": "2026-09-26T03:55:41.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96750 (GCVE-0-2026-96750)

Vulnerability from cvelistv5 – Published: 2026-09-24 15:51 – Updated: 2026-09-25 03:55

Title

Shell script injection via server-supplied database name in Open MongoDB shell

Summary

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mongodb mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/mongodb-js/compass/releases/ta…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Compass	Affected: 1.44.0 , < 1.49.12 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96750",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T03:55:27.003Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Compass",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.49.12",
              "status": "affected",
              "version": "1.44.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database\u0027s view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process\u0027s privileges. This requires the Compass user to open the shell for the affected database."
            }
          ],
          "value": "MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database\u0027s view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process\u0027s privileges. This requires the Compass user to open the shell for the affected database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:51:13.247Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb-js/compass/releases/tag/v1.49.12"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Shell script injection via server-supplied database name in Open MongoDB shell",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96750",
    "datePublished": "2026-09-24T15:51:13.247Z",
    "dateReserved": "2026-09-23T15:45:51.994Z",
    "dateUpdated": "2026-09-25T03:55:27.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2026-3583

CVE-2026-96744 (GCVE-0-2026-96744)

CVE-2026-96745 (GCVE-0-2026-96745)

CVE-2026-96746 (GCVE-0-2026-96746)

CVE-2026-96747 (GCVE-0-2026-96747)

CVE-2026-96748 (GCVE-0-2026-96748)

CVE-2026-96749 (GCVE-0-2026-96749)

CVE-2026-96750 (GCVE-0-2026-96750)

Tags

Sightings

Nomenclature

Related by attack behaviour