MongoDB C# Driver before 3.13.0 has DoS and auth-bypass flaws
Original title: MongoDB security advisory (AV26-1078)
Canada's Cyber Centre urges administrators to apply MongoDB updates for the C# Driver as they become available.
The Canadian Centre for Cyber Security published advisory AV26-1078 on October 22, 2026, covering the MongoDB C# Driver prior to 3.13.0. MongoDB describes memory-exhaustion denial of service from unbounded symbol interning during BSON or JSON deserialization, and authentication bypass through issuer-and-serial-only certificate equality in a shared cluster cache. The centre tells users and administrators to review MongoDB's links and apply necessary updates.
- The advisory serial number is AV26-1078 and the date is October 22, 2026.
- Affected product named in the alert is the C# Driver prior to 3.13.0.
- One issue is memory exhaustion during BSON or JSON deserialization.
- The second issue is certificate equality limited to issuer and serial in a shared cache.
Impact: Denial of service or authentication bypass in the C# driver
| Product | Affected | Fixed in |
|---|---|---|
| MongoDB C# Driver | Prior to 3.13.0 | 3.13.0 |
- 1.Review MongoDB's linked alerts and update the C# Driver to 3.13.0 or later.
- Vendors
- MongoDB
- Products
- C# Driver
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1078 Date: October 22, 2026 As of October 22, 2026, MongoDB is affected by vulnerabilities in the following product: C# Driver Prior to 3. 13. 0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.