CVE-2026-81524: fallo de gravedad media en MongoDB C Driver
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.3%
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
MongoDB · C DriverCVEs relacionadas — MongoDB C Driver
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-96746HIGHHeap buffer overflow via mid-scan command list growth in client topology monitoringEPSS 0.4%CVE-2026-84963MEDIUMSilent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parserEPSS 0.3%CVE-2026-84969MEDIUMHeap overflow via truncated base64 encoding of binary fields in length-limited JSON outputEPSS 0.3%CVE-2026-88036MEDIUMGridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C DriverEPSS 0.3%CVE-2026-84964HIGHHeap corruption via OCSP request double free from crafted multi-URL certificate in TLS clientEPSS 0.3%CVE-2026-106428MEDIUMOut-of-bounds read in SCRAM response parsing in MongoDB C DriverEPSS 0.2%