What’s Vulnerable › Products
MongoDB C# Driver vulnerabilities
36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 32 published in the last 12 months.
Check whether your MongoDB C# Driver version is affected
Latest MongoDB C# Driver vulnerabilities
- CVE-2026-114654 — BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards (CVSS 6.5)
- CVE-2026-114653 — Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder (CVSS 6.5)
- CVE-2026-114652 — Update operator injection via single-element list rewriting in the update builder (CVSS 6.5)
- CVE-2026-114651 — Cross-document data leak via malformed BSON array parsing in reused thread buffer (CVSS 4.0)
- CVE-2026-114650 — Plaintext exposure of encrypted fields via ANSI code-page corruption of database name (CVSS 5.9)
- CVE-2026-114649 — Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache (CVSS 6.8)
- CVE-2026-114648 — NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys (CVSS 7.6)
- CVE-2026-114647 — NoSQL operator injection via unvalidated replacement document in findOneAndReplace (CVSS 4.3)
- CVE-2026-114646 — NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire (CVSS 6.5)
- CVE-2026-114645 — Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping (CVSS 5.2)
- CVE-2026-114644 — Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization (CVSS 5.9)
- CVE-2026-114643 — Duplicate geometry fields via unvalidated GeoJSON extra members (CVSS 5.4)
- CVE-2026-106438 — Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver (CVSS 4.0)
- CVE-2026-106437 — Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver (CVSS 6.2)
- CVE-2026-106431 — One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver (CVSS 5.7)
- CVE-2026-106428 — Out-of-bounds read in SCRAM response parsing in MongoDB C Driver (CVSS 3.7)
- CVE-2026-96746 — Heap buffer overflow via mid-scan command list growth in client topology monitoring (CVSS 6.5)
- CVE-2026-93395 — Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() (CVSS 5.3)
- CVE-2026-93394 — libmongoc SCRAM client nonce-validation bypass (CVSS 3.7)
- CVE-2026-93393 — Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream (CVSS 8.1)
- CVE-2026-88036 — GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver (CVSS 8.3)
- CVE-2026-88035 — Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver (CVSS 5.5)
- CVE-2026-84965 — Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds (CVSS 5.5)
- CVE-2026-84964 — Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client (CVSS 7.5)
- CVE-2026-84963 — Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser (CVSS 5.3)