Use of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released. When an internal aggregation stage is combined with a batch size of 0, the server may read from memory that is no longer in use. Because that memory can be reused for other data before it is read, query results returned to the client may contain unrelated data from the server process. Depending on the state of memory at the time, the server process may also terminate unexpectedly. The behavior can occur when an authenticated user with read privileges runs an aggregate command that combines these two settings.
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
CVE-2026-87110 is a medium severity vulnerability in MongoDB Ops Manager that allows an unauthenticated network attacker to repeatedly request costly monitoring endpoints without rate limiting. This can cause temporary slowdowns of other traffic served by the same process.
CVE-2026-106435 is a medium severity vulnerability in the MongoDB Python Driver's binary accelerator. It involves an out-of-bounds read when decoding malformed BSON with a truncated regular-expression element lacking a trailing NUL byte. This can cause the application process to terminate if the C extension is loaded. The vulnerability is triggered only via the documented decode or decode_all API and does not affect the normal database wire-protocol path.
mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents.
Security Fix(es):
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.(CVE-2026-106428)
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.(CVE-2026-106431)
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.(CVE-2026-106437)
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.(CVE-2026-106438)
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.(CVE-2026-88035)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.(CVE-2026-88036)
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.(CVE-2026-93394)
A missing lower-bound validation in the bson_new_from_buffer() function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 (the minimum valid BSON document size) before using it in an array index calculation. When the length field is zero, the expression used to check the document's null terminator wraps to UINT32_MAX, causing a heap out-of-bounds read that crashes the process. An unauthorized party who can supply crafted BSON input to an application using this API can cause a denial of service.(CVE-2026-93395)
The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.
CVE-2026-106432 is a low-severity vulnerability in the MongoDB PHP Driver where the BSON encoder incorrectly converts string lengths to a 32-bit value without proper validation. This flaw can lead to a heap buffer overflow when encoding very large strings near 4 GiB in size, potentially causing process memory corruption or termination of the PHP process. Exploitation requires a non-default runtime configuration that permits multi-gigabyte string values and does not require interaction with the MongoDB server.
CVE-2026-106431 is an off-by-one out-of-bounds write vulnerability in the BSON bulk document writer component of the MongoDB C Driver. The flaw occurs when a document ends exactly at a specific buffer boundary, causing a single zero byte to be written just beyond the allocated heap memory. This can result in adjacent memory corruption or process termination if an attacker controls the size of serialized documents via the BSON bulk-writer API. The vulnerability affects MongoDB C Driver versions from 0.5.0 up to but not including 1.30.13, and from 2.0.0 up to but not including 2.5.6. The CVSS 4.0 base score is 5.9, indicating medium severity. No known exploits are reported in the wild, and no official patch links are provided in the data.
CVE-2026-106438 is a medium severity vulnerability in the MongoDB C Driver involving incorrect calculation during Decimal128 string parsing. The driver improperly accepts certain over-precision decimal strings with leading zeros instead of rejecting them, causing the stored or used numeric value to differ from the original input. This can occur when an actor supplies a decimal string, including via Extended JSON parsing.
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.
CVE-2026-106434 is a medium severity vulnerability in MongoDB libmongocrypt versions 1.5.0 up to but not including 1.20.5. The flaw involves improper validation of the integrity check value during explicit decryption, allowing unrecognized encrypted payloads to be returned unchanged instead of triggering a decryption error. This could lead to applications treating manipulated ciphertext as decrypted plaintext.
CVE-2026-106433 is a high-severity type confusion vulnerability in MongoDB's libmongocrypt library. It arises from improper state management when cleaning up key documents containing duplicate masterKey fields, leading to incompatible type usage. An authenticated actor who can modify key vault documents or a server returning such malformed key documents may cause invalid memory access or frees in the client process. This can result in application termination or memory corruption.
CVE-2026-107325 is a high-severity vulnerability in the MongoDB Go Driver involving improper validation of BSON array lengths. This flaw can cause an out-of-bounds index and runtime panic when bson.RawArray.Validate or bsoncore.Array.Validate is called on a malformed four-byte array. An unauthenticated attacker able to supply raw BSON array data to the affected application may cause the application process to terminate, resulting in a denial of service. There is no identified impact on confidentiality or integrity.
CVE-2026-107324 is an integer overflow vulnerability in the BSON value-length handling of the MongoDB Go Driver. This flaw can cause a runtime panic when processing malformed BSON documents, potentially leading to denial of service. An unauthenticated attacker able to supply crafted BSON bytes may cause the application to terminate. The vulnerability affects specific versions of the MongoDB Go Driver. Panic recovery in the server-monitoring path limits impact to server-selection failures in that context.
CVE-2026-106429 is an integer underflow vulnerability in MongoDB's libmongocrypt library affecting versions from 1.1.0 up to but not including 1.20.5. The flaw occurs in the KMS endpoint-parsing logic and can cause an allocation failure that terminates the application process. Exploitation requires an authenticated user to modify a key document in the key vault collection or for an application to accept a specially crafted KMS endpoint containing a colon after its path or query during key creation. This vulnerability does not lead to memory corruption or out-of-bounds access.
CVE-2026-106430 is a medium severity vulnerability in the MongoDB C++ Driver versions 3.0.0 up to but not including 4.6.1. The vulnerability arises because the driver discards content after an embedded NUL byte in certain field and collection names, leading to interpretation conflicts between the driver and the application. An authenticated user who can influence these names may cause the application to read or rename unintended fields or collections using the application's existing database credentials.
In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation.
CVE-2026-96749 is an integer overflow vulnerability in the BSON document encoding component of the MongoDB Python Driver's native extension. It occurs when a single document is constructed from a very large amount of user-supplied data, causing size arithmetic to overflow a signed 32-bit integer. This can lead to a write outside the bounds of an allocated buffer within the application's process. The vulnerability affects versions from 1.9.0 up to but not including 4.18.2. No exploits are known in the wild, and the vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-96748 is a vulnerability in the PyMongo Python driver for MongoDB where improper handling of URL encoding in connection strings can allow an attacker to inject additional servers into the client's host list. This occurs because percent-encoded characters in the host portion are decoded before splitting the host list, enabling an unauthenticated party to manipulate the connection string. As a result, the application may send authentication and database operations to attacker-controlled servers, which can observe limited information and return altered results. The issue affects PyMongo versions from 0 up to but not including 4.18.2.