Vulnerability-Lookup - Search a vulnerability

Refine your search

Product

Sort by

Order

Sources

CERTFR-2026-AVI-1386

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
MongoDB	libmongocrypt	libmmongocrypt versions antérieures à 1.21.1
MongoDB	C Driver	C Driver versions 2.5.x antérieures à 2.5.7
MongoDB	C Driver	C Driver versions antérieures à 1.30.14
MongoDB	C# Driver	C# Driver versions antérieures à 3.13.0
MongoDB	Compass	Compass versions antérieures à 1.53.1

References

Title

Publication Time

Tags

Bulletin de sécurité MongoDB CSHARP-6162	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB v1.53.1	2026-10-24	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6186	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6166	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB MONGOCRYPT-963	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6174	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6157	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6181	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6184	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6180	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6421	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6170	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6179	2026-10-22	vendor-advisory
Bulletin de sécurité MongoDB CSHARP-6168	2026-10-22	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "libmmongocrypt versions ant\u00e9rieures \u00e0 1.21.1",
      "product": {
        "name": "libmongocrypt",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C Driver versions 2.5.x ant\u00e9rieures \u00e0 2.5.7",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C Driver versions ant\u00e9rieures \u00e0 1.30.14",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C# Driver versions ant\u00e9rieures \u00e0 3.13.0",
      "product": {
        "name": "C# Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Compass versions ant\u00e9rieures \u00e0 1.53.1",
      "product": {
        "name": "Compass",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-114645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114645"
    },
    {
      "name": "CVE-2026-114652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114652"
    },
    {
      "name": "CVE-2026-114649",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114649"
    },
    {
      "name": "CVE-2026-114646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114646"
    },
    {
      "name": "CVE-2026-114648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114648"
    },
    {
      "name": "CVE-2026-114654",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114654"
    },
    {
      "name": "CVE-2026-114653",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114653"
    },
    {
      "name": "CVE-2026-114643",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114643"
    },
    {
      "name": "CVE-2026-114647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114647"
    },
    {
      "name": "CVE-2026-114650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114650"
    },
    {
      "name": "CVE-2026-114644",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114644"
    },
    {
      "name": "CVE-2026-115929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115929"
    },
    {
      "name": "CVE-2026-114651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114651"
    },
    {
      "name": "CVE-2026-114655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114655"
    }
  ],
  "initial_release_date": "2026-10-26T00:00:00",
  "last_revision_date": "2026-10-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1386",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits MongoDB. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6162",
      "url": "https://jira.mongodb.org/browse/CSHARP-6162"
    },
    {
      "published_at": "2026-10-24",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB v1.53.1",
      "url": "https://github.com/mongodb-js/compass/releases/tag/v1.53.1"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6186",
      "url": "https://jira.mongodb.org/browse/CSHARP-6186"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6166",
      "url": "https://jira.mongodb.org/browse/CSHARP-6166"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOCRYPT-963",
      "url": "https://jira.mongodb.org/browse/MONGOCRYPT-963"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6174",
      "url": "https://jira.mongodb.org/browse/CSHARP-6174"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6157",
      "url": "https://jira.mongodb.org/browse/CSHARP-6157"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6181",
      "url": "https://jira.mongodb.org/browse/CSHARP-6181"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6184",
      "url": "https://jira.mongodb.org/browse/CSHARP-6184"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6180",
      "url": "https://jira.mongodb.org/browse/CSHARP-6180"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6421",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6421"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6170",
      "url": "https://jira.mongodb.org/browse/CSHARP-6170"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6179",
      "url": "https://jira.mongodb.org/browse/CSHARP-6179"
    },
    {
      "published_at": "2026-10-22",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CSHARP-6168",
      "url": "https://jira.mongodb.org/browse/CSHARP-6168"
    }
  ]
}

CERTFR-2026-AVI-1293

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Elles permettent à un attaquant de provoquer un déni de service à distance et un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
MongoDB	C Driver	C Driver versions antérieures à 1.30.13
MongoDB	C++ Driver	C++ Driver versions antérieures à 4.6.1
MongoDB	Python Driver	Python Driver versions antérieures à 4.18.3
MongoDB	PHP Driver	PHP Driver versions 2.1.x antérieures à 2.1.11
MongoDB	PHP Driver	PHP Driver versions 2.5.x antérieures à 2.5.4
MongoDB	PHP Driver	PHP Driver versions antérieures à 1.21.11
MongoDB	C Driver	C Driver versions 2.5.x antérieures à 2.5.6
MongoDB	libmongocrypt	libmongocrypt versions antérieures à 1.20.5
MongoDB	Go Driver	Go Driver versions antérieures à 2.9.2

References

Title

Publication Time

Tags

Bulletin de sécurité MongoDB MONGOCRYPT-966	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6418	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB CXX-3551	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB MONGOCRYPT-986	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB PHPC-2741	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6370	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB PYTHON-6110	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB ops-manager-server-8027	2026-10-09	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6423	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB GODRIVER-4136	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6419	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB MONGOCRYPT-964	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB PHPC-2739	2026-10-08	vendor-advisory
Bulletin de sécurité MongoDB GODRIVER-4102	2026-10-08	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "C Driver versions ant\u00e9rieures \u00e0 1.30.13",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C++ Driver versions ant\u00e9rieures \u00e0 4.6.1",
      "product": {
        "name": "C++ Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Python Driver versions ant\u00e9rieures \u00e0 4.18.3",
      "product": {
        "name": "Python Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "PHP Driver versions 2.1.x ant\u00e9rieures \u00e0 2.1.11",
      "product": {
        "name": "PHP Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "PHP Driver versions 2.5.x ant\u00e9rieures \u00e0 2.5.4",
      "product": {
        "name": "PHP Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "PHP Driver versions ant\u00e9rieures \u00e0 1.21.11",
      "product": {
        "name": "PHP Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C Driver versions 2.5.x ant\u00e9rieures \u00e0 2.5.6",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "libmongocrypt versions ant\u00e9rieures \u00e0 1.20.5",
      "product": {
        "name": "libmongocrypt",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "Go Driver versions ant\u00e9rieures \u00e0 2.9.2",
      "product": {
        "name": "Go Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-75595",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75595"
    },
    {
      "name": "CVE-2026-59649",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59649"
    },
    {
      "name": "CVE-2026-59648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59648"
    },
    {
      "name": "CVE-2026-84445",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84445"
    },
    {
      "name": "CVE-2026-76172",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76172"
    },
    {
      "name": "CVE-2026-73088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73088"
    },
    {
      "name": "CVE-2026-84375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84375"
    },
    {
      "name": "CVE-2026-73089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73089"
    },
    {
      "name": "CVE-2026-12817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12817"
    },
    {
      "name": "CVE-2026-59640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59640"
    },
    {
      "name": "CVE-2026-56876",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56876"
    },
    {
      "name": "CVE-2026-59647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59647"
    },
    {
      "name": "CVE-2026-58059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58059"
    },
    {
      "name": "CVE-2026-75596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75596"
    },
    {
      "name": "CVE-2026-8763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8763"
    },
    {
      "name": "CVE-2026-15055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15055"
    },
    {
      "name": "CVE-2026-14682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14682"
    },
    {
      "name": "CVE-2025-71330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71330"
    },
    {
      "name": "CVE-2026-58061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58061"
    },
    {
      "name": "CVE-2026-2303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2303"
    },
    {
      "name": "CVE-2026-84369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84369"
    },
    {
      "name": "CVE-2026-12802",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12802"
    },
    {
      "name": "CVE-2026-58063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58063"
    },
    {
      "name": "CVE-2025-71329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71329"
    },
    {
      "name": "CVE-2026-84304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84304"
    },
    {
      "name": "CVE-2026-13506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13506"
    },
    {
      "name": "CVE-2026-75899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75899"
    },
    {
      "name": "CVE-2026-59642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59642"
    },
    {
      "name": "CVE-2026-75931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75931"
    },
    {
      "name": "CVE-2026-13586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13586"
    },
    {
      "name": "CVE-2026-75975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75975"
    },
    {
      "name": "CVE-2026-59639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59639"
    },
    {
      "name": "CVE-2026-84370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84370"
    }
  ],
  "initial_release_date": "2026-10-12T00:00:00",
  "last_revision_date": "2026-10-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1293",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits MongoDB. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOCRYPT-966",
      "url": "https://jira.mongodb.org/browse/MONGOCRYPT-966"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6418",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6418"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CXX-3551",
      "url": "https://jira.mongodb.org/browse/CXX-3551"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOCRYPT-986",
      "url": "https://jira.mongodb.org/browse/MONGOCRYPT-986"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB PHPC-2741",
      "url": "https://jira.mongodb.org/browse/PHPC-2741"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6370",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6370"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB PYTHON-6110",
      "url": "https://jira.mongodb.org/browse/PYTHON-6110"
    },
    {
      "published_at": "2026-10-09",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB ops-manager-server-8027",
      "url": "https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#ops-manager-server-8027"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6423",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6423"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB GODRIVER-4136",
      "url": "https://jira.mongodb.org/browse/GODRIVER-4136"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6419",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6419"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOCRYPT-964",
      "url": "https://jira.mongodb.org/browse/MONGOCRYPT-964"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB PHPC-2739",
      "url": "https://jira.mongodb.org/browse/PHPC-2739"
    },
    {
      "published_at": "2026-10-08",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB GODRIVER-4102",
      "url": "https://jira.mongodb.org/browse/GODRIVER-4102"
    }
  ]
}

CERTFR-2026-AVI-1123

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et une injection de requêtes illégitimes par rebond (CSRF).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
MongoDB	libmongocrypt	libmongocrypt versions antérieures à 1.20.4
MongoDB	PHP Driver	PHP Driver versions antérieures à 1.21.8
MongoDB	C Driver	C Driver versions antérieures à 1.30.9
MongoDB	C++ Driver	C++ Driver versions antérieures à 4.5.2
MongoDB	C Driver	C Driver versions 2.x antérieures à 2.5.2
MongoDB	PHP Driver	PHP Driver versions 2.2.x antérieures à 2.5.1
MongoDB	PHP Driver	PHP Driver versions 2.1.x antérieures à 2.1.9
MongoDB	MongoDB pour VS Code	MongoDB pour VS Code versions antérieures à 1.17.1

References

Title

Publication Time

Tags

Bulletin de sécurité MongoDB CDRIVER-6410	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB CXX-3547	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB CXX-3548	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB VSCODE-798	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB MONGOCRYPT-960	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6405	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB MONGOCRYPT-971	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB PHPC-2744	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6407	2026-09-03	vendor-advisory
Bulletin de sécurité MongoDB CDRIVER-6409	2026-09-03	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "libmongocrypt versions ant\u00e9rieures \u00e0 1.20.4",
      "product": {
        "name": "libmongocrypt",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "PHP Driver versions ant\u00e9rieures \u00e0 1.21.8",
      "product": {
        "name": "PHP Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C Driver versions ant\u00e9rieures \u00e0 1.30.9",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C++ Driver versions ant\u00e9rieures \u00e0 4.5.2",
      "product": {
        "name": "C++ Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "C Driver versions 2.x ant\u00e9rieures \u00e0 2.5.2",
      "product": {
        "name": "C Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "PHP Driver versions 2.2.x ant\u00e9rieures \u00e0 2.5.1",
      "product": {
        "name": "PHP Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "PHP Driver versions 2.1.x ant\u00e9rieures \u00e0 2.1.9",
      "product": {
        "name": "PHP Driver",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    },
    {
      "description": "MongoDB pour VS Code versions ant\u00e9rieures \u00e0 1.17.1",
      "product": {
        "name": "MongoDB pour VS Code",
        "vendor": {
          "name": "MongoDB",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-84966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84966"
    },
    {
      "name": "CVE-2026-84970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84970"
    },
    {
      "name": "CVE-2026-84969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84969"
    },
    {
      "name": "CVE-2026-84964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84964"
    },
    {
      "name": "CVE-2026-84965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84965"
    },
    {
      "name": "CVE-2026-84971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84971"
    },
    {
      "name": "CVE-2026-84967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84967"
    },
    {
      "name": "CVE-2026-84962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84962"
    },
    {
      "name": "CVE-2026-84963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84963"
    },
    {
      "name": "CVE-2026-84968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84968"
    }
  ],
  "initial_release_date": "2026-09-07T00:00:00",
  "last_revision_date": "2026-09-07T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1123",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans MongoDB. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans MongoDB",
  "vendor_advisories": [
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6410",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6410"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CXX-3547",
      "url": "https://jira.mongodb.org/browse/CXX-3547"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CXX-3548",
      "url": "https://jira.mongodb.org/browse/CXX-3548"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB VSCODE-798",
      "url": "https://jira.mongodb.org/browse/VSCODE-798"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOCRYPT-960",
      "url": "https://jira.mongodb.org/browse/MONGOCRYPT-960"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6405",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6405"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB MONGOCRYPT-971",
      "url": "https://jira.mongodb.org/browse/MONGOCRYPT-971"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB PHPC-2744",
      "url": "https://jira.mongodb.org/browse/PHPC-2744"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6407",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6407"
    },
    {
      "published_at": "2026-09-03",
      "title": "Bulletin de s\u00e9curit\u00e9 MongoDB CDRIVER-6409",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6409"
    }
  ]
}

CVE-2026-114655 (GCVE-0-2026-114655)

Vulnerability from cvelistv5

Published

2026-10-22 19:14

Modified

2026-10-22 20:38

Severity ?

6.0 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Summary

libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.

References

URL

Tags

	https://jira.mongodb.org/browse/MONGOCRYPT-963
	https://github.com/mongodb/libmongocrypt/releases/tag/1.21.1
	https://github.com/mongodb/libmongocrypt/security/advisories/GHSA-7mvq-mg47-m88j

Impacted products

	Vendor	Product	Version
	MongoDB	libmongocrypt	Version: 1.0.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.21.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application\u0027s credentials. This may result in key management operations being performed with parameters the application did not intend."
            }
          ],
          "value": "libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application\u0027s credentials. This may result in key management operations being performed with parameters the application did not intend."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T20:38:26.441Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-963"
        },
        {
          "url": "https://github.com/mongodb/libmongocrypt/releases/tag/1.21.1"
        },
        {
          "url": "https://github.com/mongodb/libmongocrypt/security/advisories/GHSA-7mvq-mg47-m88j"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "KMS request injection via unsanitized key vault and provider values in libmongocrypt",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-114655",
    "datePublished": "2026-10-22T19:14:00.708Z",
    "dateReserved": "2026-10-21T21:57:57.844Z",
    "dateUpdated": "2026-10-22T20:38:26.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106434 (GCVE-0-2026-106434)

Vulnerability from cvelistv5

Published

2026-10-08 18:56

Modified

2026-10-08 19:30

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-354 - Improper Validation of Integrity Check Value

Summary

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.

References

URL

Tags

https://jira.mongodb.org/browse/MONGOCRYPT-966

Impacted products

	Vendor	Product	Version
	MongoDB	libmongocrypt	Version: 1.5.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106434",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T19:30:38.647440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T19:30:49.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.20.5",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext."
            }
          ],
          "value": "The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354: Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T18:56:43.244Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-966"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-106434",
    "datePublished": "2026-10-08T18:56:43.244Z",
    "dateReserved": "2026-10-06T16:40:35.016Z",
    "dateUpdated": "2026-10-08T19:30:49.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106433 (GCVE-0-2026-106433)

Vulnerability from cvelistv5

Published

2026-10-08 18:55

Modified

2026-10-08 19:30

Severity ?

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Summary

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

References

URL

Tags

https://jira.mongodb.org/browse/MONGOCRYPT-964

Impacted products

	Vendor	Product	Version
	MongoDB	libmongocrypt	Version: 1.1.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106433",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T19:30:18.348159Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T19:30:26.703Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.20.5",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory."
            }
          ],
          "value": "Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T18:55:34.174Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-964"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-106433",
    "datePublished": "2026-10-08T18:55:34.174Z",
    "dateReserved": "2026-10-06T16:40:35.016Z",
    "dateUpdated": "2026-10-08T19:30:26.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106429 (GCVE-0-2026-106429)

Vulnerability from cvelistv5

Published

2026-10-08 18:54

Modified

2026-10-08 19:30

Severity ?

7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Summary

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.

References

URL

Tags

https://jira.mongodb.org/browse/MONGOCRYPT-986

Impacted products

	Vendor	Product	Version
	MongoDB	libmongocrypt	Version: 1.1.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T19:29:53.569305Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T19:30:01.396Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.20.5",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds."
            }
          ],
          "value": "An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T18:54:10.237Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-986"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-106429",
    "datePublished": "2026-10-08T18:54:10.237Z",
    "dateReserved": "2026-10-06T16:40:35.016Z",
    "dateUpdated": "2026-10-08T19:30:01.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84962 (GCVE-0-2026-84962)

Vulnerability from cvelistv5

Published

2026-09-03 15:03

Modified

2026-09-03 15:34

Severity ?

5.7 (Medium) - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
4.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-93

Summary

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

References

URL

Tags

https://jira.mongodb.org/browse/MONGOCRYPT-960

Impacted products

	Vendor	Product	Version
	MongoDB	libmongocrypt	Version: 0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84962",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:32:38.247701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:34:35.133Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.20.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user\u0027s identity, escalating database-level access into cloud key control and defeating client-side encryption."
            }
          ],
          "value": "An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user\u0027s identity, escalating database-level access into cloud key control and defeating client-side encryption."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T15:03:52.811Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-960"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Authenticated KMS request forgery via CRLF injection in GCP key identifier strings",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84962",
    "datePublished": "2026-09-03T15:03:52.811Z",
    "dateReserved": "2026-09-02T17:58:52.742Z",
    "dateUpdated": "2026-09-03T15:34:35.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84971 (GCVE-0-2026-84971)

Vulnerability from cvelistv5

Published

2026-09-03 14:57

Modified

2026-09-03 15:10

Severity ?

7.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-617 - Reachable Assertion

Summary

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

References

URL

Tags

https://jira.mongodb.org/browse/MONGOCRYPT-971

Impacted products

	Vendor	Product	Version
	MongoDB	libmongocrypt	Version: 1.7.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84971",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-03T15:10:07.983007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-03T15:10:21.808Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.20.4",
              "status": "affected",
              "version": "1.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running."
            }
          ],
          "value": "Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617: Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T14:57:35.521Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-971"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-84971",
    "datePublished": "2026-09-03T14:57:35.521Z",
    "dateReserved": "2026-09-02T17:58:52.743Z",
    "dateUpdated": "2026-09-03T15:10:21.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-81523 (GCVE-0-2026-81523)

Vulnerability from cvelistv5

Published

2026-08-27 18:32

Modified

2026-08-28 15:51

Severity ?

2.0 (Low) - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
4.4 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Summary

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

References

URL

Tags

	https://jira.mongodb.org/browse/MONGOCRYPT-977
	https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3

Impacted products

	Vendor	Product	Version
	MongoDB	libmongocrypt	Version: 1.0.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81523",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:50:43.186458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:51:12.001Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "libmongocrypt",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "1.20.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A missing input-validation issue in MongoDB libmongocrypt\u0027s automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application."
            }
          ],
          "value": "A missing input-validation issue in MongoDB libmongocrypt\u0027s automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T20:42:00.300Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://jira.mongodb.org/browse/MONGOCRYPT-977"
        },
        {
          "url": "https://github.com/mongodb/libmongocrypt/releases/tag/1.20.3"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-81523",
    "datePublished": "2026-08-27T18:32:24.206Z",
    "dateReserved": "2026-08-26T22:13:50.099Z",
    "dateUpdated": "2026-08-28T15:51:12.001Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Refine your search

10 vulnerabilities found for libmongocrypt by MongoDB

CERTFR-2026-AVI-1386

Vulnerability from certfr_avis

Solutions

CERTFR-2026-AVI-1293

Vulnerability from certfr_avis

Solutions

CERTFR-2026-AVI-1123

Vulnerability from certfr_avis

Solutions

CVE-2026-114655 (GCVE-0-2026-114655)

Vulnerability from cvelistv5

CVE-2026-106434 (GCVE-0-2026-106434)

Vulnerability from cvelistv5

CVE-2026-106433 (GCVE-0-2026-106433)

Vulnerability from cvelistv5

CVE-2026-106429 (GCVE-0-2026-106429)

Vulnerability from cvelistv5

CVE-2026-84962 (GCVE-0-2026-84962)

Vulnerability from cvelistv5

CVE-2026-84971 (GCVE-0-2026-84971)

Vulnerability from cvelistv5

CVE-2026-81523 (GCVE-0-2026-81523)

Vulnerability from cvelistv5