What’s Vulnerable › Products

MongoDB Java Driver vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your MongoDB Java Driver version is affected

Latest MongoDB Java Driver vulnerabilities

• CVE-2026-118581 — NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol (CVSS 6.5)
• CVE-2026-88033 — GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver (CVSS 8.3)
• CVE-2026-88032 — Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver (CVSS 7.5)
• CVE-2026-18710 — Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization (CVSS 6.5)
• CVE-2021-20328 — MongoDB Java driver client-side field level encryption not verifying KMS host name (CVSS 6.8)