org.mongodb vulnerabilities

Products

• org.mongodb/mongo-java-driver 1
• org.mongodb/mongodb-driver 1
• org.mongodb/mongodb-driver-legacy 1
• org.mongodb/mongodb-driver-sync 1

Latest org.mongodb CVEs

Newest publication first

1. CVE-2021-20328 MongoDB Java driver client-side field level encryption not verifying KMS host name

   Published 2021-02-25

   Medium·CVSS 6.8 EPSS 0.44%

   Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in int...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.