GCVE - cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Mongodb (`1aa156a6-63a9-5032-baaf-10197d408a1e`)
Product	C Driver (`23f7cc4a-8240-53c8-8593-cedcd3090749`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/mongo-c-driver`	purl2cpe	2026-06-01 10:11:17.456655
`pkg:deb/ubuntu/mongo-c-driver`	purl2cpe	2026-06-01 10:11:17.456659
`pkg:github/mongodb/mongo-c-driver`	purl2cpe	2026-06-01 10:11:17.456662
`pkg:rpm/fedora/mongo-c-driver`	purl2cpe	2026-06-01 10:11:17.456664
`pkg:rpm/opensuse/mongo-c-driver`	purl2cpe	2026-06-01 10:11:17.456667

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-88036`	vulnerable	2026-09-16 04:34:09.246184	GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver HIGH (8.3) Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. Published: 2026-09-10T18:09:10.536Z Updated: 2026-09-10T18:29:27.944Z Open on db.gcve.eu Reference links https://jira.mongodb.org/browse/CDRIVER-6427	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-88035`	vulnerable	2026-09-16 04:34:09.112171	Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver MEDIUM (4.7) A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it. Published: 2026-09-10T18:07:10.823Z Updated: 2026-09-10T18:29:53.256Z Open on db.gcve.eu Reference links https://jira.mongodb.org/browse/CDRIVER-6416	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-12119`	vulnerable	2026-06-08 07:04:29.718238	Bulk write with options may read invalid memory MEDIUM (6.8) A mongoc_bulk_operation_t may read invalid memory if large options are passed. Published: 2025-11-18T20:21:08.252Z Updated: 2026-01-14T19:04:31.839Z Open on db.gcve.eu Reference links https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.2 https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6 https://github.com/mongodb/mongo-c-driver/releases/tag/2.1.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-12135`	vulnerable	2026-06-08 05:17:56.601779	Details available bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input. Published: 2020-04-24T00:31:51.000Z Updated: 2024-08-04T11:48:58.185Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/ubuntu/+source/whoopsie/+bug/1872560 https://launchpadlibrarian.net/474887364/bson-fix-overflow.patch https://github.com/10gen-archive/mongo-c-driver-legacy/commit/1a1f5e26a4309480d88598913f9eebf9e9cba8ca#diff-f7d29a680148f52d6601f59ed787f577 https://usn.ubuntu.com/4450-1/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.