Vulnerability-Lookup

SUSE-SU-2026:4398-1

Vulnerability from csaf_suse - Published: 2026-09-29 16:18 - Updated: 2026-09-30 11:16

Summary

Security update for python-pymongo

Severity

Important

Notes

Title of the patch: Security update for python-pymongo

Description of the patch: This update for python-pymongo fixes the following issues: - CVE-2026-96747: improper handling of key management endpoint values ending in `.sock` allows users with write access to the encryption key metadata to open connections to local sockets on the application host (bsc#1282844). - CVE-2026-96748: host injection in connection string leading to database connection redirection due to improper connection string parsing (bsc#1282827). - CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside the bounds of an allocated buffer (bsc#1282845).

Patchnames: SUSE-2026-4398,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4398

CVE-2026-96747

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-96748

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Recommended 4 products, the same list as for CVE-2026-96747

Threats

Impact moderate

CVE-2026-96749

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 4 products, the same list as for CVE-2026-96747

Threats

Impact important

References

16 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://www.suse.com/support/update/announcement/…	self
https://bugzilla.suse.com/1282827	self
https://bugzilla.suse.com/1282844	self
https://bugzilla.suse.com/1282845	self
https://www.suse.com/security/cve/CVE-2026-96747/	self
https://www.suse.com/security/cve/CVE-2026-96748/	self
https://www.suse.com/security/cve/CVE-2026-96749/	self
https://www.suse.com/security/cve/CVE-2026-96747	external
https://bugzilla.suse.com/1282844	external
https://www.suse.com/security/cve/CVE-2026-96748	external
https://bugzilla.suse.com/1282827	external
https://www.suse.com/security/cve/CVE-2026-96749	external
https://bugzilla.suse.com/1282845	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for python-pymongo",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for python-pymongo fixes the following issues:\n\n- CVE-2026-96747: improper handling of key management endpoint values ending in `.sock` allows users with write access\n  to the encryption key metadata to open connections to local sockets on the application host (bsc#1282844).\n- CVE-2026-96748: host injection in connection string leading to database connection redirection due to improper\n  connection string parsing (bsc#1282827).\n- CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside the bounds of\n  an allocated buffer (bsc#1282845).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-4398,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4398",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4398-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:4398-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264398-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:4398-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264398-1/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282827",
        "url": "https://bugzilla.suse.com/1282827"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282844",
        "url": "https://bugzilla.suse.com/1282844"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1282845",
        "url": "https://bugzilla.suse.com/1282845"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-96747 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-96747/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-96748 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-96748/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-96749 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-96749/"
      }
    ],
    "title": "Security update for python-pymongo",
    "tracking": {
      "current_release_date": "2026-09-30T11:16:55Z",
      "generator": {
        "date": "2026-09-29T16:18:54Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:4398-1",
      "initial_release_date": "2026-09-29T16:18:54Z",
      "revision_history": [
        {
          "date": "2026-09-29T16:18:54Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-30T11:16:55Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python2-pymongo-0:3.11.0-150300.3.6.1.aarch64",
                "product": {
                  "name": "python2-pymongo-0:3.11.0-150300.3.6.1.aarch64",
                  "product_id": "python2-pymongo-0:3.11.0-150300.3.6.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python2-pymongo@3.11.0-150300.3.6.1?arch=aarch64\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
                "product": {
                  "name": "python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
                  "product_id": "python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python3-pymongo@3.11.0-150300.3.6.1?arch=aarch64\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python2-pymongo-0:3.11.0-150300.3.6.1.i586",
                "product": {
                  "name": "python2-pymongo-0:3.11.0-150300.3.6.1.i586",
                  "product_id": "python2-pymongo-0:3.11.0-150300.3.6.1.i586",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python2-pymongo@3.11.0-150300.3.6.1?arch=i586\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-pymongo-0:3.11.0-150300.3.6.1.i586",
                "product": {
                  "name": "python3-pymongo-0:3.11.0-150300.3.6.1.i586",
                  "product_id": "python3-pymongo-0:3.11.0-150300.3.6.1.i586",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python3-pymongo@3.11.0-150300.3.6.1?arch=i586\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python2-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
                "product": {
                  "name": "python2-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
                  "product_id": "python2-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python2-pymongo@3.11.0-150300.3.6.1?arch=ppc64le\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
                "product": {
                  "name": "python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
                  "product_id": "python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python3-pymongo@3.11.0-150300.3.6.1?arch=ppc64le\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python2-pymongo-0:3.11.0-150300.3.6.1.s390x",
                "product": {
                  "name": "python2-pymongo-0:3.11.0-150300.3.6.1.s390x",
                  "product_id": "python2-pymongo-0:3.11.0-150300.3.6.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python2-pymongo@3.11.0-150300.3.6.1?arch=s390x\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
                "product": {
                  "name": "python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
                  "product_id": "python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python3-pymongo@3.11.0-150300.3.6.1?arch=s390x\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python2-pymongo-0:3.11.0-150300.3.6.1.x86_64",
                "product": {
                  "name": "python2-pymongo-0:3.11.0-150300.3.6.1.x86_64",
                  "product_id": "python2-pymongo-0:3.11.0-150300.3.6.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python2-pymongo@3.11.0-150300.3.6.1?arch=x86_64\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-pymongo-0:3.11.0-150300.3.6.1.x86_64",
                "product": {
                  "name": "python3-pymongo-0:3.11.0-150300.3.6.1.x86_64",
                  "product_id": "python3-pymongo-0:3.11.0-150300.3.6.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:mongodb:pymongo:3.11.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/python3-pymongo@3.11.0-150300.3.6.1?arch=x86_64\u0026upstream=python-pymongo-0:3.11.0-150300.3.6.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-pymongo-0:3.11.0-150300.3.6.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64"
        },
        "product_reference": "python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le"
        },
        "product_reference": "python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-pymongo-0:3.11.0-150300.3.6.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x"
        },
        "product_reference": "python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-pymongo-0:3.11.0-150300.3.6.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
        },
        "product_reference": "python3-pymongo-0:3.11.0-150300.3.6.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-96747",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-96747"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in \".sock\" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-96747",
          "url": "https://www.suse.com/security/cve/CVE-2026-96747"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282844 for CVE-2026-96747",
          "url": "https://bugzilla.suse.com/1282844"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-29T16:18:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-96747"
    },
    {
      "cve": "CVE-2026-96748",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-96748"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "PyMongo\u0027s connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application\u0027s database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-96748",
          "url": "https://www.suse.com/security/cve/CVE-2026-96748"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282827 for CVE-2026-96748",
          "url": "https://bugzilla.suse.com/1282827"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-29T16:18:54Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-96748"
    },
    {
      "cve": "CVE-2026-96749",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-96749"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An integer overflow in the BSON document encoding component of the MongoDB Python Driver\u0027s bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application\u0027s own process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-96749",
          "url": "https://www.suse.com/security/cve/CVE-2026-96749"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1282845 for CVE-2026-96749",
          "url": "https://bugzilla.suse.com/1282845"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-pymongo-0:3.11.0-150300.3.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-29T16:18:54Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-96749"
    }
  ]
}

CVE-2026-96747 (GCVE-0-2026-96747)

Vulnerability from cvelistv5 – Published: 2026-09-24 18:18 – Updated: 2026-09-24 19:12

Title

Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption

Summary

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 18:36 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

mongodb mitre root Scorecard

References

3 references

URL	Tags
https://github.com/mongodb/mongo-python-driver/se…
https://github.com/mongodb/mongo-python-driver/re…
https://github.com/mongodb/mongo-python-driver/bl…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Python Driver	Affected: 3.9.0 , < 4.18.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96747",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T18:36:00.653378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T18:36:09.079Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Python Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "4.18.2",
              "status": "affected",
              "version": "3.9.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in \".sock\" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted."
            }
          ],
          "value": "The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in \".sock\" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T19:12:04.304Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96747",
    "datePublished": "2026-09-24T18:18:10.962Z",
    "dateReserved": "2026-09-23T15:45:50.286Z",
    "dateUpdated": "2026-09-24T19:12:04.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96748 (GCVE-0-2026-96748)

Vulnerability from cvelistv5 – Published: 2026-09-24 18:18 – Updated: 2026-09-24 19:12

Title

Connection redirection via percent-encoded delimiter injection in connection string hosts

Summary

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 18:36 UTC

CWE

CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

Assigner

mongodb mitre root Scorecard

References

3 references

URL	Tags
https://github.com/mongodb/mongo-python-driver/se…
https://github.com/mongodb/mongo-python-driver/re…
https://github.com/mongodb/mongo-python-driver/bl…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Python Driver	Affected: 0 , < 4.18.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T18:36:30.450714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T18:36:36.142Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Python Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "4.18.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PyMongo\u0027s connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application\u0027s database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results."
            }
          ],
          "value": "PyMongo\u0027s connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application\u0027s database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-177",
              "description": "CWE-177: Improper Handling of URL Encoding (Hex Encoding)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T19:12:05.362Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Connection redirection via percent-encoded delimiter injection in connection string hosts",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96748",
    "datePublished": "2026-09-24T18:18:12.032Z",
    "dateReserved": "2026-09-23T15:45:50.867Z",
    "dateUpdated": "2026-09-24T19:12:05.362Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96749 (GCVE-0-2026-96749)

Vulnerability from cvelistv5 – Published: 2026-09-24 18:18 – Updated: 2026-09-26 03:55

Title

Heap out-of-bounds write via signed size overflow in BSON document encoding

Summary

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 00:00 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mongodb mitre root Scorecard

References

3 references

URL	Tags
https://github.com/mongodb/mongo-python-driver/se…
https://github.com/mongodb/mongo-python-driver/re…
https://github.com/mongodb/mongo-python-driver/bl…

Impacted products

1 product

Vendor	Product	Version
MongoDB	Python Driver	Affected: 1.9.0 , < 4.18.2 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96749",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-26T03:55:41.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Python Driver",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThan": "4.18.2",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An integer overflow in the BSON document encoding component of the MongoDB Python Driver\u0027s bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application\u0027s own process."
            }
          ],
          "value": "An integer overflow in the BSON document encoding component of the MongoDB Python Driver\u0027s bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application\u0027s own process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T19:12:06.439Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
        },
        {
          "url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Heap out-of-bounds write via signed size overflow in BSON document encoding",
      "x_generator": {
        "engine": "cve_record_builder.py"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-96749",
    "datePublished": "2026-09-24T18:18:13.077Z",
    "dateReserved": "2026-09-23T15:45:51.412Z",
    "dateUpdated": "2026-09-26T03:55:41.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

SUSE-SU-2026:4398-1

CVE-2026-96747 (GCVE-0-2026-96747)

CVE-2026-96748 (GCVE-0-2026-96748)

CVE-2026-96749 (GCVE-0-2026-96749)

Tags

Sightings

Nomenclature

Related by attack behaviour