CVE-2026-126982 is a deserialization vulnerability in the BSON serialization library of the MongoDB C# Driver. It allows bypassing type allow-list restrictions during polymorphic data deserialization into loosely typed members. An attacker who can supply BSON/JSON data that the application deserializes may cause instantiation of unauthorized .NET types with attacker-controlled values. This can lead to arbitrary code execution if the application contains a suitable gadget type, resulting in loss of confidentiality, integrity, and availability. The vulnerability affects versions from 3.2.0 up to but not including 3.14.0 and is fixed in version 3.14.0.
CVE-2026-126839 is a deserialization vulnerability in the MongoDB C# Driver's BSON serialization component. It arises because the type-restriction control uses an overly permissive heuristic to identify compiler-generated types, allowing bypass. An attacker who can supply BSON content that an application deserializes into a loosely typed member can cause unintended types to be instantiated and populated with attacker-controlled data. This may lead to unexpected object states and errors in application logic. No elevated privileges beyond the ability to influence deserialization input are required. The issue affects versions from 2.21.0 up to but not including 3.14.0 and is fixed in version 3.14.0. The CVSS 4.0 score is 2.3, indicating low severity.
CVE-2026-114654 is a numeric-type conversion vulnerability in the BSON handling library of the MongoDB C# Driver. It allows an unauthenticated attacker to supply out-of-range binary subtype values via untrusted textual input, bypassing integrity checks. This causes the driver to emit malformed binary data that may be rejected or misinterpreted by subsequent readers. The issue affects versions from 2.0.0 up to but not including 3.13.0 and has been fixed in version 3.13.0.
CVE-2026-114653 is a vulnerability in the MongoDB C# Driver affecting versions 3.5.0 up to but not including 3.13.0. It involves improper handling of caller-supplied field identifiers in client-side encryption schema construction, where these identifiers are used as pattern expressions without normalization or validation. This flaw can cause client-side field-level encryption to silently fail, resulting in sensitive data being stored and returned in cleartext. No user interaction is required to trigger this condition, and any party with read access to the stored data can observe unencrypted values despite not having encryption keys. The issue is fixed in version 3.13.0.
CVE-2026-114652 is a vulnerability in the MongoDB C# Driver affecting versions from 2.0.0 up to but not including 3.13.0. It involves improper neutralization of special elements in data query logic during update statement construction, allowing application-supplied values to be interpreted as query or update logic rather than literal data. This can lead to unauthorized modification or removal of stored data by users with ordinary read-write access. The vulnerability impacts data integrity but does not affect confidentiality or availability.
CVE-2026-114651 is a vulnerability in the BSON deserialization component of the MongoDB C# Driver. It involves a memory-handling weakness where uninitialized data from previous operations may be returned when parsing specially crafted serialized input. This can lead to limited disclosure of information from other requests or users without requiring authentication or special privileges. The issue affects versions from 2.26.0 up to but not including 3.13.0 and is fixed in version 3.13.0.
CVE-2026-114650 is a vulnerability in the MongoDB .NET/C# driver affecting client-side field-level encryption. Due to a flaw in text encoding and internal name conversion, data meant to be encrypted may be stored in plaintext without error. This compromises confidentiality but does not affect data integrity or availability. The issue affects certain versions of the driver and has been fixed in version 3.13.0.
CVE-2026-114649 is a vulnerability in the MongoDB C# Driver where TLS client certificates are compared only by issuer and serial number to determine if clients can share cached connections. This allows an attacker who supplies a certificate with the same issuer and serial number as another user, but without the private key, to reuse connections authenticated as that other user. This can lead to unauthorized database operations under the victim's identity, impacting data confidentiality and integrity.
CVE-2026-114648 is a vulnerability in the MongoDB C# Driver where dot and dollar characters in dictionary keys, field names, and array-filter identifiers used in LINQ queries are not properly neutralized. This allows an attacker who can influence these inputs to redirect queries or updates to unintended fields, potentially exposing other users' documents or causing malformed stored documents that the application cannot read until repaired. The issue affects versions from 2.14.0 up to but not including 3.13.0 and has been fixed in version 3.13.0.
CVE-2026-114647 is a vulnerability in the MongoDB C# Driver where the FindOneAndReplace operation does not reject replacement documents with top-level field names starting with a dollar sign. This allows an application that constructs such documents from user input to have the server apply update operators instead of performing a full replacement. The modification is limited to documents matched by the application's own filter, potentially altering document contents in unintended ways.
CVE-2026-114646 is a vulnerability in the MongoDB C# Driver affecting versions from 2.0.0 up to but not including 3.13.0. It involves improper handling of length parameters in BSON binary serialization, allowing an unauthenticated attacker who can supply binary data to manipulate database commands issued by the application. This can lead to unauthorized modification or disclosure of data within the scope of the application's database privileges. The issue is fixed in version 3.13.0.
CVE-2026-114644 is a high-severity vulnerability in the MongoDB C# Driver's BSON library affecting versions from 2.0.0 up to but not including 3.13.0. It involves uncontrolled resource consumption during deserialization of a specific BSON value type, allowing an unauthenticated remote attacker to cause unbounded memory growth and denial of service. This issue does not impact confidentiality or integrity and does not affect MongoDB server components.
CVE-2026-114643 is a vulnerability in the MongoDB C# Driver where GeoJSON extra members are written without checking for name collisions with reserved GeoJSON members like type and coordinates. This can cause documents to have duplicate geometry fields, leading to inconsistencies between the server and driver in resolving record values. Affected records may become unreadable through the driver, disrupting application code that reads them.