MongoDB C# Driver vulnerabilities

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material to be reproduced verbatim in the driver's human-readable diagnostic representation of client settings, instead of being masked as other secret fields are.

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips it back into client configuration, the untrusted text is serialized without neutralizing URL/option delimiters and then re-parsed as authoritative connection options.

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements.

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. Special elements in application-supplied values are not properly escaped before the query is sent to the database.

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application incorporating untrusted input into these names can have operations directed at a resource other than intended.

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may have its operation directed at a different target than intended.

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic.