本ページは mongodb c_driver に影響する公開済み CVE（NVD の CPE 経由で関連付け）を列挙します。各行に深刻度指標・概要・公開日が含まれます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2026-6231 | The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version | [email protected] | 5.3 | 0.05% | 2026-04-13 | 2026-05-06 |
| CVE-2026-4359 | A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver. | [email protected] | 2.0 | 0.03% | 2026-03-17 | 2026-04-02 |
| CVE-2025-12119 | A mongoc_bulk_operation_t may read invalid memory if large options are passed. | [email protected] | 6.9 | 0.01% | 2025-11-18 | 2026-01-14 |
| CVE-2024-7553 | Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files. This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to | [email protected] | 7.3 | 0.22% | 2024-08-07 | 2024-09-19 |
| CVE-2023-0437 | When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This issue affects All MongoDB C Driver versions prior to versions 1.25.0. | [email protected] | 5.3 | 0.05% | 2024-01-12 | 2025-11-03 |
| CVE-2021-32050 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default). This | [email protected] | 4.2 | 0.04% | 2023-08-29 | 2025-11-03 |
| CVE-2020-12135 | bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input. | [email protected] | 5.5 | 0.35% | 2020-04-24 | 2024-11-21 |