An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field values, unintended selection of documents for application-initiated writes, and reduced database performance.
Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance.
CVE-2026-93761 is a high-severity vulnerability in the Mongoid library by MongoDB Inc. It involves inefficient regular expression complexity in the in-memory query evaluation component. An unauthenticated attacker can supply crafted text in a pattern-matching query on embedded associations, causing excessive processing and potentially making the application unresponsive. This affects multiple Mongoid versions from 7.2.0 through 9.1.0 as specified. No known exploits are reported in the wild, and no patch information is provided in the source data.
Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records.
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.
Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becoming unresponsive.
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.
CVE-2026-93395 is an integer underflow vulnerability in the bson_new_from_buffer() function of the MongoDB C Driver. The function fails to validate that the BSON document length is at least 5 bytes, allowing a zero-length prefix to cause an integer wraparound. This leads to a heap out-of-bounds read and a process crash, resulting in a denial of service. The vulnerability affects versions from 2.0.0 up to but not including 2.3.1. No known exploits are reported in the wild. The CVSS 4.0 score is 6.9, indicating a medium severity.
CVE-2026-93394 is a vulnerability in MongoDB Inc.'s C Driver (libmongoc) affecting versions from 2.0.0 up to but not including 2.3.2. The flaw lies in the SCRAM authentication implementation, where the client proceeds with the authentication handshake and sends the client proof even if a nonce mismatch is detected in the server's first message. This could allow a man-in-the-middle attacker to inject a crafted server message and capture the client proof, potentially enabling offline password cracking. The vulnerability is mitigated by the use of TLS, which is standard in production environments.
CVE-2026-93393 is a critical heap-based buffer overflow vulnerability in the TLS transport layer of the MongoDB C Driver when built with the Windows TLS backend. A remote endpoint can trigger out-of-bounds writes during processing of encrypted traffic after the TLS handshake, without requiring authentication or user interaction. This can cause memory corruption, disclosure of adjacent heap memory, or process termination.
Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption.
If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys.
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.
Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.
CVE-2026-8063 is a high-severity vulnerability in MongoDB Server versions 8.2.0 prior to 8.2.7. It allows an authenticated user to crash the mongod process by running $rankFusion or $scoreFusion aggregation stages with an empty pipeline on a view. The issue arises because the server attempts to read the first element of each stage's input pipeline array without checking if the array is empty, leading to a null pointer dereference and server crash.
CVE-2026-6691 is a high-severity vulnerability in the MongoDB C Driver version 2.1.0. It involves unsafe string copying in the Cyrus SASL integration during username canonicalization, leading to a heap buffer overflow. This flaw can be triggered by passing untrusted input in the username field of a MongoDB URI when using the GSSAPI authentication mechanism. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1
A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution (SBE) engine when an in-memory hash table is spilled to disk.
