CVE-2026-126837 Attacker able to redirect a client's database traffic to a host they control via special characters in an SRV target, bypassing the SRV parent-domain guard

A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host outside the expected domain. For a mongodb+srv:// connection string, the driver checks each host name in the DNS SRV response against the domain of the connection string. The...

CVE-2026-126837

A validation flaw exists in the DNS SRV host discovery of the MongoDB Node.js driver . When using a mongodb+srv:// connection string, the driver validates hostnames against the connection string's domain but fails to account for specific characters that terminate the hostname early during address...

Fedora 29 : mongo-c-driver (2018-2f8f5f75f1)

libbson 1.13.0 Features: - New functions to save and restore progress of a bsonitert: bsoniterkeylen, bsoniteroffset, and soniterinitfromdataatoffset Additional functions bsoniteroverwritedatetime, bsoniteroverwriteoid, and bsoniteroverwritetimestamp. All fixed-length BSON values can now be updat...