VulnSea

java_driver vulnerabilities

CVEs whose affected-version data names the java_driver package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

4 CVEsRSS

CVE-2026-118581Medium· 6.5
4d ago

NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing databa…

▾ SunlitMongoDB · Java Drivervia CVEORG
CVE-2026-88033High· 8.3
1mo ago

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal ide…

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal ide…

▾ Twilightmongodb · java_driverEPSS 0.46%via NVD
CVE-2026-88032Medium· 5.9
1mo ago

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able t…

▾ Sunlitmongodb · java_driverEPSS 0.26%via NVD
CVE-2026-18710Medium· 6.5
2mo ago

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatic…

▾ Sunlitmongodb · java_driverEPSS 0.14%via NVD
java_driver vulnerabilities (CVEs) · VulnSea