CVE-2026-114643

5.4 MEDIUMpublic exploit available

Published 2026-10-22 · Updated 2026-10-23

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weaknesses

CWE-694

Public exploit & PoC references

https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-mqvm-xxqr-vqw5

All references

https://github.com/mongodb/mongo-csharp-driver/releases/tag/v3.13.0
https://github.com/mongodb/mongo-csharp-driver/security/advisories/GHSA-mqvm-xxqr-vqw5
https://jira.mongodb.org/browse/CSHARP-6179

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-102634PoC
MEDIUMCVE-2026-108752PoC
MEDIUMCVE-2026-112906PoC
MEDIUMCVE-2026-78359

Related by shared AI tags and CWE weakness class. Browse the full archive.