Skip to content
OpenAdvisories
Medium WID-SEC-2026-3182 3 CVEs

MongoDB: Mehrere Schwachstellen

Published Sep 3, 2026 · Updated Sep 3, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen MongoDB Treibern und einer Bibliothek ausnutzen, um Daten zu manipulieren oder offenzulegen, sowie um einen Denial of Service Zustand herbeizuführen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-84971

    Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

    Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an applicat…

    MongoDB libmongocrypt libmongocrypt libmongocrypt Debian Ubuntu
  • Medium 6.2
    CVE-2026-84970

    Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser

    A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can c…

    MongoDB C Driver mongo-cxx-driver mongo-cxx-driver Debian Ubuntu
  • Low 3.7
    CVE-2026-84969

    Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output

    A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who …

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu Alpine

Revision history

  1. #1

    Initiale Fassung

References