Threats affecting pkg:maven/org.mongodb/mongodb-driver

CVE-2026-88033 is a vulnerability in the GridFS component of the MongoDB Java Driver where improper neutralization of special elements in data query logic allows an attacker to manipulate file identifiers. An authenticated user who can influence the identifier may access unintended stored file content, cause deletion of all GridFS file chunks in a bucket, or rename files other than the intended target. This affects versions from 3.3.0 up to but not including 5.11.1. The vulnerability has a medium severity with a CVSS score of 6.1.

CVE-2026-88032 is a high-severity use-after-free vulnerability in the reactive client-side encryption component of the MongoDB Java Driver. It occurs when native resources are freed while an encrypted operation is still using them if the operation is cancelled. Exploitation requires a reactive encryption setup that retrieves KMS credentials on demand. Successful exploitation can cause the hosting application process to terminate.

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.