CVE-2026-96748

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-96748
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96748.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-96748
Aliases
  • GHSA-vp6j-j7w5-5xjj
Downstream
Published
2026-09-24T18:18:12Z
Modified
2026-09-26T08:05:07Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Connection redirection via percent-encoded delimiter injection in connection string hosts
Details

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

Database specific 
{
    "cna_assigner":  "mongodb",
    "cwe_ids":  [
        "CWE-177"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96748.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "4.18.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/mongodb/mongo-python-driver

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo-python-driver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

0.*
0.10
0.10.1
0.10.2
0.10.3
0.11
0.11.1
0.11.2
0.11.3
0.12
0.13
0.14
0.14.1
0.14.2
0.15
0.15.1
0.15.2
0.16
0.4pre
0.5.1pre
0.5.2pre
0.5.3pre
0.5pre
0.6
0.7
0.7.1
0.7.2
0.8
0.8.1
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
1.*
1.0
1.1
1.1.1
1.1.2
1.10
1.10.1
1.11
1.2
1.2.1
1.3
1.4
1.5
1.5.1
1.6
1.7
1.8
1.8.1
1.9
2.*
2.0
2.0.1
2.1
2.1.1
2.2
2.2.1
2.2rc1
2.3
2.3rc1
2.4
2.4.1
2.4.2
2.5
2.5.1
2.6
2.7
2.7rc0
2.7rc1
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0b0
3.0b1
3.0rc0
3.0rc1
3.1
3.1.1
3.10.0
3.10.1
3.11.0
3.11.0b0
3.11.0b1
3.11.0rc0
3.11.1
3.1rc0
3.2
3.2.1
3.2.2
3.2rc0
3.3.0
3.4.0
3.4rc0
3.5.0
3.5.1
3.6.0
3.6.1
3.6rc0
3.7.0
3.7.0b0
3.9.0
3.9.0b0
3.9.0b1
4.*
4.0
4.1.0
4.1.1
4.10.0
4.10.1
4.11
4.12.0
4.13.0
4.13.0.dev0
4.13.0.dev1
4.15.0
4.15.1
4.16.0
4.16.0.dev0
4.18.0
4.18.1
4.2.0
4.2.0b0
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0
4.4.0b0
4.5.0
4.6.0
4.7.0
4.7.1
4.9
4.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96748.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "313937259246690792033577136582351186585",
                "234329394194398214755767972931697391149",
                "205556081000686217523895440862638542136",
                "302023848532793530739864523738009957657",
                "229744238530264298010148702012829395894",
                "289566845193397341247368850510323650999",
                "61373660942318224200464922469282204245",
                "1377657727013732018681638084855295901",
                "100276382119081194731334726091889527063",
                "49150128683341948243584376855512715628",
                "282432437761933900027570562394692470410",
                "161491051014087500058901029099508351084",
                "79846178355188504907962075812862958840",
                "339487331988713150960607797990096285080"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-96748-5d3a46dc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7",
        "target":  {
            "file":  "bson/buffer.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "306396228315852703488053070048897984029",
            "length":  295
        },
        "id":  "CVE-2026-96748-ccd4fb31",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7",
        "target":  {
            "file":  "bson/buffer.c",
            "function":  "buffer_assure_space"
        }
    }
]
vanir_signatures_modified 
"2026-09-26T08:05:07Z"