CVE-2026-81522

CVE-2026-81522 affects the MongoDB C++ Driver and involves improper handling of caller-supplied namespace identifiers. The root cause is that special characters—specifically dot and NUL characters —embedded in those identifiers can cause an application's operation to be directed at a different da...

CVE-2026-88034

CVE-2026-88034 affects the GridFS component of the MongoDB C++ Driver . The root cause is improper neutralization of special elements in data query logic: a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user w...

CVE-2026-84970

A numeric truncation (32-bit length truncation) in the JSON parsing component of the MongoDB C++ Driver's BSON library allows a local attacker to supply an oversized JSON string to the library's public parsing interface, causing a heap over-read (out-of-bounds memory returned to the caller), a si...

CVE-2026-84966

An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application passes an extremely large, non-terminated field name to the builder, the library may read memory outside the intended ...