Skip to content
OpenAdvisories
High WID-SEC-2026-3453 5 CVEs

MongoDB C Driver und Entity Framework Core Provider: Mehrere Schwachstellen

Published Sep 17, 2026 · Updated Sep 17, 2026 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um Informationen offenzulegen oder um einen Denial-of-Service-Zustand herbeizuführen.

Product

MongoDB ist ein Open-Source-Dokumentendatenbank.

Vulnerabilities 5

  • High 8.1
    CVE-2026-93393

    Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream

    A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap…

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2026-92757

    Malformed connection string may disable field level encryption

    Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.

    MongoDB MongoDB Entity Framework Core Provider
  • Medium 5.5
    CVE-2026-92758

    Logs may collect sensitive information

    If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.

    MongoDB MongoDB Entity Framework Core Provider
  • Medium 5.3
    CVE-2026-93395

    Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

    A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the …

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu
  • Low 3.7
    CVE-2026-93394

    libmongoc SCRAM client nonce-validation bypass

    A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-m…

    MongoDB C Driver mongo-c-driver mongo-c-driver Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References