CVEs.

Matching CVEs

1. 5.3Med

   CVE-2026-120820 ↗ (opens in a new tab)

   MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process.

   MAMongoDB Atlas· Nov 10, 2026

2. 5.3Med

   CVE-2026-120819 ↗ (opens in a new tab)

   A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated user holding only read privileges to cause the server to access memory that has already been released. By submitting a specially crafted database command that runs user-supplied JavaScript, the user can cause a bounded amount of adjacent process memory to be returned in the command's result. This results in the user obtaining information they are not authorized to access. Integrity and availability are not affected.

   MAMongoDB Atlas· Nov 10, 2026

3. 6.0Med

   CVE-2026-120812 ↗ (opens in a new tab)

   An issue in MongoDB Server's query processing component allows an authenticated user with read privileges to cause a denial of service. Uncontrolled recursion in an internal query compilation component can lead to stack exhaustion and server process termination when processing certain queries against time-series collections.

   MAMongoDB Atlas· Nov 10, 2026

4. 6.0Med

   CVE-2026-120811 ↗ (opens in a new tab)

   A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.

   MAMongoDB Atlas· Nov 10, 2026

5. 6.1Med

   CVE-2026-120809 ↗ (opens in a new tab)

   A use-after-free read issue exists in MongoDB’s SBE (Slot-Based Execution) engine when processing aggregation pipelines with $unwind on time-series collections. An internal error in state-preservation logic can cause a value still referenced by downstream stages to have its underlying memory freed prematurely. An authenticated user can craft an aggregation pipeline under specific conditions to trigger this condition, potentially reading recycled server heap memory in query results or crashing the server. This issue is only triggerable when a non-default server parameter related to the SBE engi

   MAMongoDB Atlas· Nov 10, 2026

6. 6.0Med

   CVE-2026-120952 ↗ (opens in a new tab)

   An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type is retrieved into a fixed-width client-side target. The driver produces a textual form of the value that is longer than the fixed target the ODBC interface defines, and copies it without limiting the copy to the target's real size. A database user with basic write privileges can influence part of the data written outside the target, which may corrupt memory in the application using the driver and cause that application to terminate unexpectedly.

   MAMongoDB Atlas· Nov 3, 2026

7. 6.3Med

   CVE-2026-120954 ↗ (opens in a new tab)

   A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number of elements described by an oversized attacker-supplied value. On builds where the platform word size is 32 bits, an application that parses untrusted BSON data can be made to process only a small fraction of the supplied elements while the operation reports success, producing results that disagree with byte-oriented accessors and with 64-bit builds of the same library. No authentication or user interaction is required beyond getting the application to pa

   MAMongoDB Atlas· Nov 3, 2026

8. 5.1Med

   CVE-2026-120953 ↗ (opens in a new tab)

   A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.

   MAMongoDB Atlas· Nov 3, 2026

9. 6.0Med

   CVE-2026-120684 ↗ (opens in a new tab)

   A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialized process memory to be treated as valid file content and stored on the server. A database user holding ordinary write access to a shared storage area can arrange conditions under which an application later appends to such a file and writes that memory into records the same user is permitted to read, which may result in unintended disclosure of sensitive information from the application's process, including credentials.

   MAMongoDB Atlas· Nov 3, 2026

10. 6.8Med

    CVE-2026-120673 ↗ (opens in a new tab)

    A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

    MAMongoDB Atlas· Nov 3, 2026

11. 5.2Med

    CVE-2026-119675 ↗ (opens in a new tab)

    MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior.

    MAMongoDB Atlas· Nov 3, 2026

12. 5.9Med

    CVE-2026-119672 ↗ (opens in a new tab)

    MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard output instead of a local file. If standard output is captured in a location accessible to that user, this may disclose GridFS content the user cannot read directly. Exploitation requires a higher-privileged operator to retrieve the affected file without an explicit local destination and attacker access to

    MAMongoDB Atlas· Nov 3, 2026

13. 6.9Med

    CVE-2026-118581 ↗ (opens in a new tab)

    A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to i

    MAMongoDB Atlas· Oct 28, 2026

14. 6.0Med

    CVE-2026-114655 ↗ (opens in a new tab)

    libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application d

    MAMongoDB Atlas· Oct 22, 2026

15. 6.9Med

    CVE-2026-114654 ↗ (opens in a new tab)

    A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire representation, producing binary elements that misdeclare their type or length. An unauthenticated party able to supply text parsed by an affected application can cause it to emit and persist malformed binary data, which subsequent readers either reject with an error or silently interpret as shorter tha

    MAMongoDB Atlas· Oct 22, 2026

16. 6.3Med

    CVE-2026-114651 ↗ (opens in a new tab)

    A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply serialized data to an application that maps certain primitive collection types can cause residual bytes from unrelated data processed earlier on the same execution thread to be surfaced as legitimate values. This can result in disclosure of a limited amount of information belonging to other requests or principals of the consuming application.

    MAMongoDB Atlas· Oct 22, 2026

17. 6.9Med

    CVE-2026-114650 ↗ (opens in a new tab)

    A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses information, so the encryption layer fails to associate the operation with its configured encryption rules and the operation proceeds without an error being raised. An application user with the ability to write data through an affected application can therefore have sensitive fields persisted in plaintext, defeating the confidentiality g

    MAMongoDB Atlas· Oct 22, 2026

18. 5.3Med

    CVE-2026-114647 ↗ (opens in a new tab)

    The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.

    MAMongoDB Atlas· Oct 22, 2026

19. 6.9Med

    CVE-2026-114646 ↗ (opens in a new tab)

    A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity declared inside that data matches the amount of data actually provided, and it copies the data onto the wire unchanged. An unauthenticated party who can supply binary content to such an application can thereby cause additional elements to be inserted into, or existing elements to be removed from, the database command the application issu

    MAMongoDB Atlas· Oct 22, 2026

20. 5.7Med

    CVE-2026-114645 ↗ (opens in a new tab)

    A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Win

    MAMongoDB Atlas· Oct 22, 2026

21. 5.3Med

    CVE-2026-114643 ↗ (opens in a new tab)

    The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.

    MAMongoDB Atlas· Oct 22, 2026

22. 6.0Med

    CVE-2026-96297 ↗ (opens in a new tab)

    Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges

    MAMongoDB Atlas· Oct 13, 2026

23. 5.3Med

    CVE-2026-103965 ↗ (opens in a new tab)

    An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

    MAMongoDB Atlas· Oct 13, 2026

24. 6.9Med

    CVE-2026-87110 ↗ (opens in a new tab)

    An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue.

    MAMongoDB Atlas· Oct 9, 2026

25. 6.0Med

    CVE-2026-87109 ↗ (opens in a new tab)

    An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.

    MAMongoDB Atlas· Oct 9, 2026

26. 5.9Med

    CVE-2026-106435 ↗ (opens in a new tab)

    The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.

    MAMongoDB Atlas· Oct 8, 2026

27. 6.3Med

    CVE-2026-106436 ↗ (opens in a new tab)

    The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.

    MAMongoDB Atlas· Oct 8, 2026

28. 5.1Med

    CVE-2026-106438 ↗ (opens in a new tab)

    An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.

    MAMongoDB Atlas· Oct 8, 2026

29. 5.9Med

    CVE-2026-106437 ↗ (opens in a new tab)

    The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.

    MAMongoDB Atlas· Oct 8, 2026

30. 5.3Med

    CVE-2026-106434 ↗ (opens in a new tab)

    The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.

    MAMongoDB Atlas· Oct 8, 2026

31. 5.9Med

    CVE-2026-106431 ↗ (opens in a new tab)

    An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.

    MAMongoDB Atlas· Oct 8, 2026

32. 6.0Med

    CVE-2026-106430 ↗ (opens in a new tab)

    The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.

    MAMongoDB Atlas· Oct 8, 2026

33. 6.3Med

    CVE-2026-106428 ↗ (opens in a new tab)

    An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.

    MAMongoDB Atlas· Oct 8, 2026

34. 5.3Med

    CVE-2026-96747 ↗ (opens in a new tab)

    The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.

    MAMongoDB Atlas· Sep 24, 2026

35. 6.3Med

    CVE-2026-96745 ↗ (opens in a new tab)

    Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the applica

    MAMongoDB Atlas· Sep 24, 2026

36. 6.9Med

    CVE-2026-93395 ↗ (opens in a new tab)

    A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an a

    MAMongoDB Atlas· Sep 17, 2026

37. 6.3Med

    CVE-2026-93394 ↗ (opens in a new tab)

    A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.

    MAMongoDB Atlas· Sep 17, 2026

38. 5.7Med

    CVE-2026-92758 ↗ (opens in a new tab)

    If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.

    MAMongoDB Atlas· Sep 17, 2026

39. 6.8Med

    CVE-2026-92757 ↗ (opens in a new tab)

    Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

    MAMongoDB Atlas· Sep 17, 2026

40. 6.8Med

    CVE-2026-92756 ↗ (opens in a new tab)

    Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.

    MAMongoDB Atlas· Sep 17, 2026

41. 6.1Med

    CVE-2026-88036 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

42. 5.7Med

    CVE-2026-88035 ↗ (opens in a new tab)

    A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

    MAMongoDB Atlas· Sep 10, 2026

43. 6.1Med

    CVE-2026-88034 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

44. 6.1Med

    CVE-2026-88033 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

45. 6.1Med

    CVE-2026-88031 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

46. 6.1Med

    CVE-2026-88030 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

47. 6.1Med

    CVE-2026-88029 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

48. 6.1Med

    CVE-2026-88025 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026

49. 6.1Med

    CVE-2026-88024 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

    MAMongoDB Atlas· Sep 10, 2026

50. 6.1Med

    CVE-2026-88023 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.

    MAMongoDB Atlas· Sep 10, 2026