AZL-105107 CVE-2026-96748 affecting package python-pymongo 4.2.0-9

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

AZL-105113 CVE-2026-96747 affecting package python-pymongo 4.2.0-9

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

DEBIAN-CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

AZL-105110 CVE-2026-96749 affecting package python-pymongo 4.2.0-9

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

UBUNTU-CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

A flaw was found in pymongo. The driver improperly decodes percent-encoded characters in connection strings before separating host entries on delimiters. If an application incorporates untrusted hostnames into its connection strings, a remote attacker can inject arbitrary servers into the databas...

CVE-2026-96747

A flaw was found in pymongo. When client-side field-level encryption is configured, the driver misinterprets Key Management Service KMS endpoint addresses ending in '.sock' as local Unix domain socket files rather than remote network hosts. An authenticated database user with permission to modify...

CVE-2026-96749

A flaw was found in pymongo. An integer overflow exists in the bundled native extension for Binary JSON BSON document encoding when processing an unusually large amount of data. An unprivileged attacker who can submit oversized data to an application for encoding can trigger an arithmetic overflo...

2d6io-cryptobot (0.0.1), academic-metrics (>=0.1.0b0, <=1.0.99) +1409 more potentially affected by CVE-2026-96749 via pymongo (>=2.4.1, <=4.18.1)

pymongo PYPI version =2.4.1, =0.1.0b0, =1.0.4, =0.9.0, =0.4.2, =0.3.0, =3.6.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =1.3.2 - ai-flow 0.3.1 and more Source cves: CVE-2026-96749 Source advisory: MEND:CVE-2026-96749...

2d6io-cryptobot (0.0.1), academic-metrics (>=0.1.0b0, <=1.0.99) +1409 more potentially affected by CVE-2026-96749 via pymongo (>=2.4.1, <=4.18.1)

pymongo PYPI version =2.4.1, =0.1.0b0, =1.0.4, =0.9.0, =0.4.2, =0.3.0, =3.6.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =1.3.2 - ai-flow 0.3.1 and more Source cves: CVE-2026-96749 Source advisory: SNYK:PYTHON-PYMONGO-20158816...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in bufferassurespace in bson/buffer.c of the bundled C extension, where buffer-position + size is computed in a signed int and the guard meant to catch the wraparound is written as newsize position, a test...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

2d6io-cryptobot (0.0.1), academic-metrics (>=0.1.0b0, <=1.0.99) +1382 more potentially affected by CVE-2026-96748 via pymongo (>=3.5.0, <=4.18.1)

pymongo PYPI version =3.5.0, =0.1.0b0, =1.0.4, =0.9.0, =0.4.2, =0.3.0, =3.6.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =1.3.2 - ai-flow 0.3.1 and more Source cves: CVE-2026-96748 Source advisory: SNYK:PYTHON-PYMONGO-20158849...

2d6io-cryptobot (0.0.1), academic-metrics (>=0.1.0b0, <=1.0.99) +1398 more potentially affected by CVE-2026-96748 via pymongo (>=3.2.0, <=4.18.1)

pymongo PYPI version =3.2.0, =0.1.0b0, =1.0.4, =0.9.0, =0.4.2, =0.3.0, =3.6.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =1.3.2 - ai-flow 0.3.1 and more Source cves: CVE-2026-96748 Source advisory: MEND:CVE-2026-96748...

CVE-2026-96748

The PyMongo database driver is vulnerable to connection redirection due to percent-encoded delimiter injection in connection string hosts. The root cause is that PyMongo decodes percent-encoded characters in the host portion before separating the host list by delimiters. If an application include...