Threats affecting pkg:brew/mongo-orchestration

A vulnerability in dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade or deny service to applications that handle untrusted DNS wire format messages using dnspython. The issue is fixed in dnspython version 2.9.0. No workarounds are currently known.

A vulnerability in the MongoDB Python Driver's C extension BSON decoder allows an out-of-bounds read when decoding a malformed Regex element from certain buffer types. This can cause the process to crash with an uncatchable SIGSEGV, impacting availability. The issue affects all releases through 4.18.2 when the C extension is loaded. The vulnerability is fixed in PyMongo 4.18.3. Applications decoding untrusted BSON from non-NUL-terminated buffers such as mmap or array buffers are vulnerable. Using NUL-terminated buffers or upgrading to the fixed version mitigates the issue.

CVE-2026-96749 is a high-severity integer overflow vulnerability in the BSON document encoding component of the MongoDB Python Driver's native extension. It occurs when encoding a single document constructed from a very large amount of data, causing signed 32-bit size arithmetic to overflow. This can lead to a heap out-of-bounds write inside the application's process memory. The flaw affects mongo-orchestration versions from 0.5 up to but not including 0.11.2_4. A fix is available in version 0.11.2_4.

PyMongo versions prior to 0.11.2_4 improperly percent-decoded the entire host section of MongoDB connection strings before splitting hosts, allowing percent-encoded delimiters (%2C for comma, %3A for colon) to inject additional attacker-controlled hosts. This could cause the client to connect to malicious servers, potentially exposing credentials or routing operations to attacker hosts. The issue is fixed in PyMongo 0.11.2_4 by restricting percent-decoding to Unix domain socket paths only after splitting hosts. Applications should avoid interpolating untrusted input into the host portion of connection strings or validate such input carefully.

PyMongo versions >=0.7.0 and <0.11.2_4 contain a vulnerability where the KMS endpoint from a key vault document is passed verbatim to a host parser. If the endpoint ends with '.sock', the driver treats it as a Unix domain socket path and attempts an AF_UNIX connection. This allows an attacker who can write to the key vault collection to redirect KMS connections to arbitrary Unix socket paths on the application host. The TLS handshake always fails, so no KMS messages are sent. The issue is fixed in PyMongo 0.11.2_4.

CVE-2026-88029 is a vulnerability in pymongo's GridFS API where the delete methods do not require an exact match on the file ID. If a hash is provided instead of the exact ID, it may be interpreted as criteria, potentially overriding the intended ID match. This could lead to unintended deletions or modifications when using the GridFS API. A patch addressing this issue is available in pymongo version 4.18.1 and later.

An out-of-bounds read vulnerability exists in the bson module of pymongo versions before 4.6.3. This flaw allows an attacker to craft a payload that forces the parser to deserialize unmanaged memory, potentially causing exceptions when parsing non-printable UTF-8 bytes. The issue is fixed in pymongo version 4.6.3.