C Driver vulnerabilities
19 known vulnerabilities in C Driver from MongoDB. 19 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
C# Driver: Deserialization of Untrusted Data
A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON dat
- 7.1 High severity
C Driver: Reachable Assertion
The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. Th
- 7.5 High severity
C Driver: NULL Pointer Dereference
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file
- 7.5 High severity
C Driver: Missing Release of Memory after Effective Lifetime
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may caus
- 7.6 High severity
C# Driver: Improper Neutralization of Special Elements in Data Query Logic
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these
- 7.4 High severity
C Driver: Integer Underflow (Wrap or Wraparound)
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who ca
- 8.1 High severity
C Driver: Out-of-bounds Write
A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap
- 8.3 High severity
C Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated
- 8.3 High severity
C++ Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticate
- 8.3 High severity
C# Driver: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated
- 7.5 High severity
C Driver: Double Free
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be re
- 7.1 High severity
C# Driver: Improper Neutralization of Argument Delimiters in a Command
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client
- 8.1 High severity
C++ Driver: Improper Encoding or Escaping of Output
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have it
- 7.1 High severity
C Driver: Improper Validation of Specified Index, Position, or Offset in Input
The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division
- 7.8 High severity
MongoDB C Driver: Out-of-bounds Write
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a M
- 7.5 High severity
The bson_validate function may return early on specific inputs and incorrectly report success.
The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The
- 7.8 High severity
MongoDB Server: Improper Access Control
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted
- 7.5 High severity
MongoDB C Driver: Loop with Unreachable Exit Condition
When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0.
- 7.2 High severity
MongoDB .NET/C# Driver: Deserialization of Untrusted Data
Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all Mong