CVE-2026-114643

EUVD-2026-108303

22.10.2026, 19:17

The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
mongodb	CNA	5.4 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 29.94%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
mongodb	c_driver	1.8.0 ≤ 𝑥 < 3.13.0	CNA

Common Weakness Enumeration

CWE-694 - Use of Multiple Resources with Duplicate Identifier
The software uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Vulnerability Media Exposure

[GERMAN] MongoDB C# Treiber: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in MongoDB C# Treiber ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.
Published: 2026-10-22T22:00:00+00:00

References

https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0

https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-mqvm-xxqr-vqw5

https://jira.mongodb.org/browse/CSHARP-6179