SB2026092467 - Multiple vulnerabilities in mongo-python-driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092467

SB2026092467 - Multiple vulnerabilities in mongo-python-driver

Published: September 24, 2026

Security Bulletin ID SB2026092467
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Integer overflow (CVE-ID: CVE-2026-96749)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to write outside the bounds of an allocated buffer.

The vulnerability exists due to an integer overflow in the BSON document encoding component of the bundled native extension when encoding a document built from an unusually large amount of caller-supplied data. A remote attacker can supply an unusually large value for encoding to write outside the bounds of an allocated buffer.

Exploitation depends on how the native extension was built.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-96747)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to initiate a connection to an arbitrary Unix domain socket.

The vulnerability exists due to improper input validation in the _EncryptionIO.kms_request KMS endpoint handling when processing a .sock-suffixed KMS endpoint from a key vault document. A remote user can set masterKey.endpoint on a data key to an attacker-chosen socket path to initiate a connection to an arbitrary Unix domain socket.

Only applications using client-side field level encryption or Queryable Encryption with a key vault writable by untrusted parties are affected. The connection is wrapped in a verifying TLS context, so the TLS handshake fails and no KMS message is sent.


3) Improper Handling of URL Encoding (Hex Encoding) (CVE-ID: CVE-2026-96748)

CWE-ID: CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose credentials or route operations to an attacker-controlled server.

The vulnerability exists due to improper handling of URL encoding in PyMongo connection string host parsing when processing connection strings containing untrusted host input. A remote attacker can supply a hostname fragment containing percent-encoded delimiters to inject an attacker-controlled host and port into the client's seed list.

Unix domain socket paths are not affected.


Remediation

Install update from vendor's website.

References