ROOT-APP-PYPI-CVE-2026-96749 CVE-2026-96749 in pymongo - Patched by Root

Root has patched CVE-2026-96749 in the pymongo package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-96748 CVE-2026-96748 in pymongo - Patched by Root

Root has patched CVE-2026-96748 in the pymongo package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1792396649 TuxCare security update for pymongo (2 CVEs)

TuxCare rebuilt pymongo to address 2 CVEs. Fixed in 3.13.0.post2+tuxcare...

MiracleLinux 8 : python36:3.6 (AXSA:2026-2086:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2086:01 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding...

Oracle Linux 8 : python36:3.6 (ELSA-2026-82858)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-82858 advisory. - Fix CVE-2021-27291: ReDos via crafted malicious input Resolves: rhbz1943459 rhbz1943460 python-pymongo - Backport CVE-2026-88029 python-PyMySQL - Security fi...

mongodb-migrations (0.1.1), rolabesti (>=0.1.0, <=0.5.3) potentially affected by CVE-2026-96749 via pymongo (3.2.1)

pymongo PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - mongodb-migrations 0.1.1 - rolabesti =0.1.0, =0.5.3 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

general-tools (>=0.1.4, <=0.2.1), happymongo-py3 (0.1.2) +3 more potentially affected by CVE-2026-96749 via pymongo (3.7.0)

pymongo PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - general-tools =0.1.4, =0.1.0, =23.0.3, =23.0.7 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

2d6io-cryptobot (0.0.1), academic-metrics (>=0.1.0b0, <=1.0.99) +1382 more potentially affected by CVE-2026-96748 via pymongo (>=3.5.0, <=4.18.1)

pymongo PYPI version =3.5.0, =0.1.0b0, =1.0.4, =0.9.0, =0.4.2, =0.3.0, =3.6.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =1.3.2 - ai-flow 0.3.1 and more Source cves: CVE-2026-96748 Source advisory: OSV:PYSEC-2026-4297...

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

SummaryPyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...

PYSEC-2026-4297 PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

Summary PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list...

sd-python-wrapper (>=0.1.2, <=0.1.26) potentially affected by CVE-2026-96749 via pymongo (3.2.0)

pymongo PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - sd-python-wrapper =0.1.2, =0.1.26 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

inmanta (2016.6.0) potentially affected by CVE-2026-96749 via pymongo (2.7.0)

pymongo PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - inmanta 2016.6.0 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

gakp-pylib (>=0.2.7, <=0.9.3), khan-mongo (0.1.6) +1 more potentially affected by CVE-2026-96749 via pymongo (3.2.2)

pymongo PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - gakp-pylib =0.2.7, =1.3.0, =1.4.0 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-96749 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

amoniak (1.0.2), aws-scripts (>=0.0.20, <=0.1.12) +6 more potentially affected by CVE-2026-96749 via pymongo (2.9.5)

pymongo PYPI version 2.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - amoniak 1.0.2 - aws-scripts =0.0.20, =0.4.2, =2.0.3, =0.1.3, =2.0.0, =2.3.0 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

mongoext (>=0.2.0, <=0.2.3), mongoops (>=0.0.1, <=1.0.1) potentially affected by CVE-2026-96749 via pymongo (2.8.0)

pymongo PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - mongoext =0.2.0, =0.0.1, =1.0.1 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

mongoext (>=0.3.0, <=0.4.0) potentially affected by CVE-2026-96749 via pymongo (3.0.0)

pymongo PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - mongoext =0.3.0, =0.4.0 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

restart-mongo (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-96749 via pymongo (2.7.2)

pymongo PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - restart-mongo =0.1.0, =0.1.4 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

lathermail (>=0.3.1, <=0.4.2) potentially affected by CVE-2026-96749 via pymongo (2.7.1)

pymongo PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - lathermail =0.3.1, =0.4.2 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...