C Driver

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

Published: 2026-04-13T15:31:55.735Z
Updated: 2026-04-13T19:23:42.752Z

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

Published: 2026-03-17T19:42:03.476Z
Updated: 2026-03-18T20:00:06.747Z

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

Published: 2025-11-18T20:21:08.252Z
Updated: 2026-01-14T19:04:31.839Z

Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue

Published: 2024-08-07T09:57:49.818Z
Updated: 2024-08-07T15:27:46.258Z

When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.

Published: 2024-01-12T13:33:39.503Z
Updated: 2025-11-03T19:27:57.046Z