MongoDB C# driver 3.13.0 fixes 11 CVEs, some with public exploits

MongoDB C

driver 3.13.0 fixes 11 CVEs, some with public exploits

22 October 2026: MongoDB has released version 3.13.0 of its .NET driver with fixes for 11 CVEs, among them NoSQL injection paths, a way for encrypted fields to reach the server in plain text, and a flaw that lets one client certificate share another's authenticated connections. Italy's national cybersecurity agency said a day later that proof-of-concept exploits are available. Every release before 3.13.0 is affected; the range for individual flaws starts as far back as 1.8.0 or 2.0.0.

Not yet independently verified. MongoDB has published the fixes in its GitHub release and advisories rather than on a mongodb.com security page; the report that proof-of-concept exploits are available comes from Italy's ACN. We will update this when it can be confirmed, and remove this note.

The flaws that matter most

Three stand out for applications that handle other people's data:

• CVE-2026-114649, shared connections across certificates: the driver decided whether two clients could share a cluster by comparing only a client certificate's issuer and serial number. An application that builds clients from certificates supplied by different users could hand one user connections authenticated as another. 3.13.0 compares the full certificate's SHA-256 hash and whether a private key is present.
• CVE-2026-114653 and CVE-2026-114650, client-side encryption failures: an unescaped field name in the CSFLE schema builder could silently leave a field unencrypted, and on Windows a database name passed in the ANSI code page could stop a schema map from matching, exposing encrypted fields in plain text.
• CVE-2026-114644, memory exhaustion: unbounded interning of BSON symbols during deserialisation lets crafted input exhaust memory. The GitHub advisory rates it high and lists MongoDB.Bson from 2.0.0 up to 3.13.0 as affected.

The other seven cover injection through mismatched raw BSON length prefixes (CVE-2026-114646), single-value update builders (CVE-2026-114652), replacement documents in findOneAndReplace (CVE-2026-114647), dictionary keys spliced into LINQ field paths (CVE-2026-114648) and GeoJSON members that collide with declared ones (CVE-2026-114643), plus output corruption from out-of-range binary subtypes (CVE-2026-114654) and a data leak between documents through a reused parsing buffer (CVE-2026-114651).

Why the upgrade needs testing

MongoDB warns that several fixes make the driver stricter, and asks users to read the behaviour changes before upgrading:

Area	What now happens in 3.13.0
Raw BSON	an inconsistent length prefix throws ArgumentException
Binary data	subtypes outside 0 to 255 are rejected
Update builders	PushEach and AddToSetEach with one value render $each; PullAll with one value renders $pullAll
findOneAndReplace	a replacement starting with $ throws ArgumentException
LINQ	names containing ".", leading "$" or positional operators throw NotSupportedException
GeoJSON	an extra member named like a declared one throws BsonSerializationException
Obsolete APIs	BsonSymbolTable and the field-expression PatternProperty overload

Code that relied on the old, looser behaviour, for example passing user-supplied dictionary keys straight into LINQ filters, will start throwing exceptions. In most cases that exception marks the place where the injection risk was.

Exploits and exposure

ACN's alert of 23 October says proofs of concept exist for several of the flaws, all already fixed by the vendor, and rates their combined systemic impact as critical. The injection and LINQ flaws matter most where an application lets users shape queries or documents; the certificate flaw matters for multi-tenant services that connect on behalf of customers with their own certificates. The release also fixes WithTransaction not retrying transient transaction errors when MongoClientSettings is created with its constructor.

Sources

• MongoDB on GitHub: .NET Driver Version 3.13.0 Release Notes, 22 October 2026
• GitHub Security Advisory GHSA-x24v-h3xm-qf9x (MongoDB.Bson), 22 October 2026
• [ACN CSIRT Italia: MongoDB, PoC available for numerous vulnerabilities in C

Driver](https://www.acn.gov.it/portale/w/mongodb-disponibili-poc-per-numerose-vulnerabilita-in-c-driver), 23 October 2026