MongoDB security advisory (AV26-1122)

Reported by Canadian Centre for Cyber Security

Summary by Cyber Security News4 Nov 2026, 20:26 CET

About this summary. This is a short excerpt from the description that Canadian Centre for Cyber Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://cyber.gc.ca/en/alerts-advisories/mongodb-security-advisory-av26-1122

Serial number: AV26-1122 Date: November 4, 2026 As of November 3, 2026, MongoDB is affected by vulnerabilities in the following product: C Driver Prior to 1.30.15 Prior to 2.5.8 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Failure to parse OP_COMPRESSED reply can leak mongoc_gridfs_bucket_download_to_stream may abort on bad metadata MongoDB Alerts

Read the full article at Canadian Centre for Cyber Security →

Source attribution: headline and facts are from Canadian Centre for Cyber Security (cyber.gc.ca). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

OpenBSD security advisory (AV26-1130)

OpenSSH flaw lets attackers log into password-disabled Linux accounts

OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

Rubyonrails security advisory (AV26-1129)