Fedora 44 : mongo-c-driver (2026-4286ff2dfd)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4286ff2dfd advisory. libbson 1.30.11 Fixes - Fix length check in bsonnewfrombuffer. ---- libmongoc 1.30.11 Fixes - Fix allocation in Windows Secure Channel. - Fix error...

Fedora 45 : mongo-c-driver (2026-0fcc2d09c6)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0fcc2d09c6 advisory. libmongoc 2.5.4 Fixes - Fix allocation in Windows Secure Channel. ---- libmongoc 2.5.3 Fixes - Use exact match for file ID in GridFS methods...

UBUNTU-CVE-2026-96746

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

Fedora 43 : mongo-c-driver (2026-f74926c622)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f74926c622 advisory. libmongoc 1.30.9 Fixes - Fix OCSP error handling. CVE-2026-84964 - Fix unsafe casts during JSON parsing. CVE-2026-84965 - Fix possible unsafe...

CVE-2026-96746

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the...

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound via the bsonnewfrombuffer function. An attacker can cause a crash by supplying crafted BSON data with a zero-length prefix, leading to a heap out-of-bounds read when the function fails to validate th...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to improper validation in the SCRAM authentication process. An attacker can intercept authentication handshakes and obtain the client proof by injecting a crafted...

Astra Linux – Vulnerability in Wireshark

MONGO and ZigBee TLV dissector have infinite loops in Wireshark versions 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22. These bugs allow for denial of service through packet injection or with properly crafted capture files...

[SECURITY] Fedora 44 Update: mongo-c-driver-1.30.9-1.fc44

mongo-c-driver is a client library written in C for MongoDB...

[SECURITY] Fedora 43 Update: mongo-c-driver-1.30.9-1.fc43

mongo-c-driver is a client library written in C for MongoDB...

[SECURITY] Fedora 45 Update: mongo-c-driver-2.5.2-1.fc45

mongo-c-driver is a client library written in C for MongoDB...

Fedora 44 : mongo-c-driver (2026-8ed63cce6b)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8ed63cce6b advisory. libmongoc 1.30.9 Fixes - Fix OCSP error handling. CVE-2026-84964 - Fix unsafe casts during JSON parsing. CVE-2026-84965 - Fix possible unsafe...

CVE-2026-88031

A flaw was found in go.mongodb.org/mongo-driver for version 1.17.10 and 2.9.1. Improper handling of data query elements in the GridFS component can lead to a file identifier being misinterpreted as a query. An authenticated user can exploit this to delete all GridFS file chunks, making stored fil...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via improper neutralization of special elements in the GridFS process. An attacker can access unauthorized file content or delete all file chunks by injecting query operato...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the BSON-to-JSON conversion process when a binary field is encoded and the output is truncated at a specified length limit. An attacker can alter a small amount of data outside the intended buffer by supplying...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the OCSP certificate revocation checking process during a TLS handshake with a trusted endpoint. An attacker can cause the client application to terminate unexpectedly by sending specially crafted certificate data that...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the JSON parsing process. An attacker can cause the application to terminate unexpectedly by supplying a specially crafted large JSON input, leading to memory corruption and potential denial of service...

Malicious Package

Overview express-mongo-limit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: argo-events, nri-haproxy, cloud-provider-gcp-cloud-controller-manager, swagger, envconsul, amazon-cloudwatch-agent-operator, conftest, cilium-cli, buildkitd, emissary, mockgen, kubernetes-dashboard, rancher-system-agent, k8sgateway, docker-credential-gcr,...

Security Bulletin:Vulnerability in Mongo affects IBM Netezza Appliance

Summary The Mongo package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-2303 Vulnerability Details CVEID:CVE-2026-2303 DESCRIPTION: The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. The C...