Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pymongo

7 known vulnerabilities (2 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 4 medium
Weekly downloads
17.2M
Dependents
4,232
Registry
PyPI

Advisories 7

  • CVE-2026-106435Medium 5.9

    Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

    Affected: from 3.9.0, fixed in 4.18.3.

  • Heap out-of-bounds write via signed size overflow in BSON document encoding

    Affected: fixed in 4.18.2.

  • Connection redirection via percent-encoded delimiter injection in connection string hosts

    Affected: from 3.5.0, fixed in 4.18.2.

  • CVE-2026-96747Medium 5.3

    Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption

    Affected: from 3.9.0, fixed in 4.18.2.

  • CVE-2026-88029Medium 6.1

    GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver

    Affected: fixed in 4.18.1.

  • CVE-2024-5629Medium 4.7

    Out-of-bounds read in bson module of PyMongo

    Affected: fixed in 4.6.3.

  • bson/_cbsonmodule.c in the mongo-python-driver (aka.

    Affected: fixed in 2.5.2.