MongoDB security advisory (AV26-1024)
Canadian Cyber Centre advisory urges updating MongoDB Go Driver before 2.9.0/2.9.2 and libmongocrypt before 1.20.5 to fix BSON parsing and KEK issues.
The Canadian Centre for Cyber Security issued advisory AV26-1024 on October 9, 2026, covering MongoDB vulnerabilities in Go Driver versions prior to 2.9.0 and 2.9.2, and libmongocrypt prior to 1.20.5. Described issues include a duplicate masterKey field re-parsing into the same KEK, int32 length overflow in bsoncore.valueLength, and BSON lengths below the 5-byte minimum. Users and administrators are encouraged to apply updates as they become available.
- MongoDB Go Driver versions before 2.9.0 and 2.9.2 affected.
- libmongocrypt versions before 1.20.5 affected.
- Fixes cover KEK reuse and BSON parsing edge cases.
- Apply necessary updates as they become available.
- Organizations
- MongoDBCanadian Centre for Cyber Security
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-1024 Date: October 9, 2026 As of October 8, 2026, MongoDB is affected by vulnerabilities in the following products: Go Driver Prior to 2. 9. 0 Prior to 2.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.