MongoDB C++ Driver vulnerabilities

Latest MongoDB C++ Driver CVEs

Newest publication first

1. CVE-2026-106430 Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver

   Published 2026-10-08

   Medium·CVSS 6.0 EPSS 0.18%

   The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name p...

2. CVE-2026-88034 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver

   Published 2026-09-10

   Medium·CVSS 6.1 EPSS 0.46%

   Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influ...

3. CVE-2026-84966 BSON element injection via NUL-embedded document keys in builder append

   Published 2026-09-03

   Medium·CVSS 5.9 EPSS 0.15%

   An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory ou...

4. CVE-2026-84970 Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser

   Published 2026-09-03

   Medium·CVSS 5.9 EPSS 0.12%

   A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to r...

5. CVE-2026-81522 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

   Published 2026-08-27

   High·CVSS 8.6 EPSS 0.46%

   A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.