CVE-2026-114643: medium-severity vulnerability in MongoDB C# Driver
Duplicate geometry fields via unvalidated GeoJSON extra members
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
MongoDB · C# DriverRelated CVEs — MongoDB C# Driver
In the same product, most dangerous first.
CVE-2026-114644HIGHMemory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserializationEPSS 0.5%CVE-2026-88025MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# DriverEPSS 0.5%CVE-2026-114651MEDIUMCross-document data leak via malformed BSON array parsing in reused thread bufferEPSS 0.4%CVE-2026-88026HIGHRegular expression injection via unescaped characters in LINQ query translation in MongoDB C# DriverEPSS 0.4%CVE-2026-114654MEDIUMBSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guardsEPSS 0.3%CVE-2026-114648HIGHNoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keysEPSS 0.3%