rpm package
opensuse/python-pymongo&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/python-pymongo&distro=openSUSE%20Leap%2016.0
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-96749 | Hig | 8.4 | < 4.6.3-bp160.2.1 | 4.6.3-bp160.2.1 | Sep 24, 2026 | An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guar | |
| CVE-2026-96748 | Med | 6.5 | < 4.6.3-bp160.2.1 | 4.6.3-bp160.2.1 | Sep 24, 2026 | PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause addition | |
| CVE-2026-96747 | Med | 5.0 | < 4.6.3-bp160.2.1 | 4.6.3-bp160.2.1 | Sep 24, 2026 | The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can |
- affected < 4.6.3-bp160.2.1fixed 4.6.3-bp160.2.1
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guar
- affected < 4.6.3-bp160.2.1fixed 4.6.3-bp160.2.1
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause addition
- affected < 4.6.3-bp160.2.1fixed 4.6.3-bp160.2.1
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can