MongoDB: Ten Driver and Extension Vulnerabilities Disclosed Together
A batch of ten MongoDB vulnerabilities, primarily impacting drivers, were disclosed on September 3, 2026, with issues ranging from BSON parsing flaws to client-side encryption weaknesses.
Key findings
- Ten MongoDB vulnerabilities disclosed on September 3, 2026, affecting drivers and extensions.
- Multiple BSON parsing and memory handling flaws found across C++, PHP, and C drivers.
- One vulnerability allows escalation of database access to cloud key control via KMS API calls.
- Visual Studio Code extension vulnerable to connection string manipulation.
- Client-side encryption decryption path issues can lead to process termination.
- All vulnerabilities rated Medium or Low severity, patched in driver updates.
On September 3, 2026, a batch of ten vulnerabilities was disclosed for various components of MongoDB, with a majority affecting the MongoDB drivers. These vulnerabilities, disclosed within a three-hour window, range in severity from Low to Medium, with several related to BSON parsing and memory handling.
Several vulnerabilities stem from issues within the BSON decoding and parsing components across different drivers. CVE-2026-84968, affecting the MongoDB PHP driver, involves an out-of-bounds read in BSON decoding that could lead to unintended disclosure of adjacent process memory within error messages. Similarly, CVE-2026-84966 and CVE-2026-84963, impacting the MongoDB C++ Driver and MongoDB C Driver respectively, detail incorrect numeric type conversions and silent shortening of text values during BSON document building and JSON parsing, potentially leading to memory access outside intended buffers. CVE-2026-84965, also in the BSON library's JSON parsing code within the C++ Driver, exploits an integer wraparound in allocation size calculation, leading to a buffer being released while a copy operation continues to write through a stale pointer. CVE-2026-84970, another issue in the MongoDB C++ Driver's BSON library, involves numeric truncation during JSON parsing of large inputs, potentially causing the library to read memory beyond the supplied buffer. CVE-2026-84969, a low-severity vulnerability in the MongoDB C Driver's BSON-to-JSON conversion, can result in a small number of bytes being written past the end of a heap buffer during conversion.
Other vulnerabilities touch upon different aspects of the MongoDB ecosystem. CVE-2026-84967, affecting the MongoDB extension for Visual Studio Code, involves a failure to neutralize special characters in a connection string before it's used in a command line for an integrated terminal, potentially allowing an attacker to persuade a developer to accept a malicious connection string. CVE-2026-84964, found in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver, is a double-free vulnerability that can be reached during the TLS handshake with specially formed certificate data, potentially allowing an unauthenticated party to trigger the vulnerability. CVE-2026-84971, related to client-side encryption, involves improper handling of unexpected value sizes in the decryption path, which can lead to a process termination. Lastly, CVE-2026-84962, a more severe medium-rated vulnerability, allows an unauthorized user with key vault write access to potentially escalate database-level access into cloud key control by causing an authorized client to issue arbitrary authenticated Google Cloud KMS API calls.
The majority of these vulnerabilities appear to be fixed in recent driver releases. Users are advised to consult the specific advisories for each affected driver and component to determine the exact versions patched and to apply updates promptly. The coordinated disclosure of these ten vulnerabilities highlights the ongoing security efforts within the MongoDB ecosystem and the importance of keeping drivers and extensions up to date.
This batch of disclosures underscores the need for continuous vigilance, particularly concerning the security of data parsing components and client-side encryption mechanisms. Users should prioritize updating their MongoDB drivers and extensions to mitigate the risks associated with these newly identified weaknesses. The broad range of affected components, from core drivers to development tools, emphasizes a comprehensive approach to security patching.