Mongodb: >> C Driver >> 2.1.0 Security Vulnerabilities
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
CVSS Score
6.1
EPSS Score
0.003
Published
2026-09-10
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.
CVSS Score
6.3
EPSS Score
0.002
Published
2026-09-03
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.
CVSS Score
8.6
EPSS Score
0.001
Published
2026-05-06
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
CVSS Score
6.9
EPSS Score
0.002
Published
2025-11-18