CVE Feed

    Dashboard / CVE / CVE-2026-114643

    CVE-2026-114643

    The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.

    Published:Oct 22, 2026
    Last Modified:Nov 2, 2026
    EPS:Oct 22, 2026
    EPSS Score:0.00372
    CVSS Score:5.4

    Affected Products

    Vendor
    Mongodb
    Product
    C# Driver

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-114654 (CVSS 6.9) — A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range bi…
    CVE-2026-114653 (CVSS 7.1) — A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field i…
    CVE-2026-114652 (CVSS 7.1) — A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Dr…
    CVE-2026-114651 (CVSS 6.3) — A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left …
    CVE-2026-114650 (CVSS 6.9) — A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for clien…
    CVE-2026-114649 (CVSS 7.6) — The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether …
    CVE-2026-114648 (CVSS 7.2) — The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-…
    CVE-2026-114647 (CVSS 5.3) — The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar si…
    CVE-2026-114646 (CVSS 6.9) — A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. Whe…
    CVE-2026-114644 (CVSS 8.2) — The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserializa…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High