100 matches found
CVE-2026-112072
The vault-java-driver (a Java client for HashiCorp Vault) is vulnerable to a StackOverflowError due to an uncontrolled recursion issue in its vendored minimal-json parser . The parser lacks a nesting depth limit, allowing deeply nested JSON values to crash the reading thread. This impact is persi...
CVE-2026-109408
The io.github.jopenlibs:vault-java-driver (versions 5.2.0 through 6.2.3) is vulnerable to a flaw where it silently disables TLS certificate and hostname verification. The root cause occurs in three specific scenarios: when an SslConfig is passed to VaultConfig without calling build(), when an Ssl...
CVE-2026-118581
A flaw was found in the MongoDB Java Driver. The BSON Binary JSON encoding component fails to verify that an externally supplied raw document's declared length matches its actual byte range before copying it into an outgoing database command. A remote attacker can exploit this flaw by submitting...
Linux Distros Unpatched Vulnerability : CVE-2026-118581
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...
CVE-2026-118581
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
DEBIAN-CVE-2026-118581
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
CVE-2026-118581
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
CVE-2026-118581 NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
CVE-2026-118581
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
EUVD-2026-112257
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
CVE-2026-118581
The MongoDB Java Driver contains a vulnerability in its BSON encoding component where it fails to verify that an externally supplied raw document's self-declared length matches the actual byte range provided. If an application wraps untrusted raw bytes into such a document for use in a database c...
CVE-2026-118581 NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
MongoDB Java Driver input validation error vulnerability
A vulnerability related to input validation exists in MongoDB Java Driver versions 5.8.0 through 5.14.0. This vulnerability stems from the BSON encoding component failing to verify whether the declared length of externally supplied raw documents matches their byte range. As a result, when the...
PT-2026-128315
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
CVE-2026-118581: Improper Neutralization of Special Elements in Data Query Logic
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...
Security Bulletin: IBM Maximo Application Suite uses mongo-java-driver-3.12.14.jar which is vulnerable to CVE-2026-88033
Summary IBM Maximo Application Suite uses mongo-java-driver-3.12.14.jar which is vulnerable to CVE-2026-88033. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-88033 DESCRIPTION: Improper neutralization of special elements in dat...
CVE-2026-88032
A flaw was found in the MongoDB Java Driver. A use-after-free vulnerability in the reactive client-side encryption component can occur when an encrypted operation is cancelled. An attacker able to cause such an operation to be cancelled may cause the hosting application process to terminate. This...
CVE-2026-88033
A flaw was found in the GridFS component of the MongoDB Java Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user can exploit th...
Linux Distros Unpatched Vulnerability : CVE-2026-88033
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file...