CVE-2026-118581

A flaw was found in the MongoDB Java Driver. The BSON Binary JSON encoding component fails to verify that an externally supplied raw document's declared length matches its actual byte range before copying it into an outgoing database command. A remote attacker can exploit this flaw by submitting...

Linux Distros Unpatched Vulnerability : CVE-2026-118581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of t...

CVE-2026-118581

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

DEBIAN-CVE-2026-118581

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-118581

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-118581 NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

EUVD-2026-112257

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-118581

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-118581

The MongoDB Java Driver contains a vulnerability in its BSON encoding component where it fails to verify that an externally supplied raw document's self-declared length matches the actual byte range provided. If an application wraps untrusted raw bytes into such a document for use in a database c...

CVE-2026-118581 NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

MongoDB Java Driver input validation error vulnerability

A vulnerability related to input validation exists in MongoDB Java Driver versions 5.8.0 through 5.14.0. This vulnerability stems from the BSON encoding component failing to verify whether the declared length of externally supplied raw documents matches their byte range. As a result, when the...

PT-2026-128315

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-118581: Improper Neutralization of Special Elements in Data Query Logic

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

CVE-2026-88032

A flaw was found in the MongoDB Java Driver. A use-after-free vulnerability in the reactive client-side encryption component can occur when an encrypted operation is cancelled. An attacker able to cause such an operation to be cancelled may cause the hosting application process to terminate. This...

CVE-2026-88033

A flaw was found in the GridFS component of the MongoDB Java Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user can exploit th...

Linux Distros Unpatched Vulnerability : CVE-2026-88033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file...

Linux Distros Unpatched Vulnerability : CVE-2026-88032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted...

DEBIAN-CVE-2026-88033

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

DEBIAN-CVE-2026-88032

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...