Threats affecting pkg:maven/org.mongodb/mongo-java-driver

CVE-2026-118581 is a vulnerability in the BSON encoding component of the MongoDB Java Driver versions 5.8.0 up to but not including 5.14.0. It allows an attacker who can supply raw bytes to the application to craft a structurally inconsistent BSON document that causes the database to interpret extra attacker-controlled fields in a command. This can result in unintended modification of the executed database command, potentially altering data read or written under the application's credentials. No authentication or user interaction is required beyond influencing the raw bytes.