MongoDB C# Driver
31 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114654 | 2.0.0 – < 3.13.0 | BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-114653 | 3.5.0 – < 3.13.0 | Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder | HIGH 7.1 | 0.2 % | ||
| CVE-2026-114652 | 2.0.0 – < 3.13.0 | Update operator injection via single-element list rewriting in the update builder | HIGH 7.1 | 0.3 % | ||
| CVE-2026-114651 | 2.26.0 – < 3.13.0 | Cross-document data leak via malformed BSON array parsing in reused thread buffer | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-114650 | 2.10.0 – < 3.13.0 | Plaintext exposure of encrypted fields via ANSI code-page corruption of database name | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-114649 | 1.8.0 – < 3.13.0 | Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache | HIGH 7.6 | 0.2 % | ||
| CVE-2026-114648 | 2.14.0 – < 3.13.0 | NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys | HIGH 7.2 | 0.3 % | ||
| CVE-2026-114647 | 2.13.0 – < 3.13.0 | NoSQL operator injection via unvalidated replacement document in findOneAndReplace | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-114646 | 2.0.0 – < 3.13.0 | NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-114645 | 1.6.0 – < 1.30.14 ; 2.0.0 – < 2.5.7 | Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping | MEDIUM 5.7 | 0.2 % | ||
| CVE-2026-114644 | 2.0.0 – < 3.13.0 | Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization | HIGH 8.2 | 0.5 % | ||
| CVE-2026-114643 | 1.8.0 – < 3.13.0 | Duplicate geometry fields via unvalidated GeoJSON extra members | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-106438 | 1.4.0 – < 1.30.13 ; 2.0.0 – < 2.5.6 | Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-106437 | 1.4.0 – < 1.30.13 ; 2.0.0 – < 2.5.6 | Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-106431 | 0.5.0 – < 1.30.13 ; 2.0.0 – < 2.5.6 | One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-106428 | 1.1.0 – < 1.30.13 ; 2.0.0 – < 2.4.0 | Out-of-bounds read in SCRAM response parsing in MongoDB C Driver | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-96746 | < 1.30.12 ; 2.0.0 – < 2.5.5 | Heap buffer overflow via mid-scan command list growth in client topology monitoring | HIGH 8.3 | 0.4 % | ||
| CVE-2026-88036 | 1.14.0 – < 1.30.10 ; 2.0.0 – < 2.5.3 | GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-88035 | 2.2.0 – < 2.5.3 | Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver | MEDIUM 5.7 | 0.1 % | ||
| CVE-2026-88026 | 2.14.0 – 3.11.1 | Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver | HIGH 7.1 | 0.4 % | ||
| CVE-2026-88025 | 2.3.0 – 3.11.1 | GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver | MEDIUM 6.1 | 0.5 % | ||
| CVE-2026-84963 | 1.10.0 – < 1.30.9 ; 2.0.0 – < 2.5.2 | Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-84964 | 1.17.0 – < 1.30.9 ; 2.0.0 – < 2.5.2 | Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client | HIGH 8.2 | 0.3 % | ||
| CVE-2026-84965 | 1.10.0 – < 1.30.9 ; 2.0.0 – < 2.5.2 | Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-84969 | 1.30.0 – < 1.30.9 ; 2.0.0 – < 2.5.2 | Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-81530 | 2.10.0 – < 3.11.1 | KMS master key exposure via unredacted credential serialization in driver settings string | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-81529 | 2.0.0 – < 3.11.1 | Connection-option injection via unescaped settings in the canonical MongoDB URL builder | HIGH 7.1 | 0.3 % | ||
| CVE-2026-81528 | 2.9.0 – < 3.11.1 | NoSQL injection via array replacement bypassing update shape validation in driver write path | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-81527 | 2.14.0 – < 3.11.1 | NoSQL injection via unquoted constant GroupBy keys in LINQ pipeline translation | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-81524 | 1.0.0 – < 2.5.1 | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-12119 | 1.9.0 – 1.30.5 ; 2.0.0 – 2.1.1 | Bulk write with options may read invalid memory | MEDIUM 6.9 | 0.2 % |