https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 20:50:36 +0000 https://db.gcve.eu/vuln/brew-mongo-orchestration-cve-2026-96748 <p><strong>Affected:</strong> Homebrew: mongo-orchestration</p> <p>### Summary</p> <p>PyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client&#39;s seed list.</p> <p>### Impact</p> <p>An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo&#39;s parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker&#39;s host, exposing credentials, or route operations to it.</p> <p>Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.</p> <p>### Patches</p> <p>Fixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.</p> <p>### Workarounds</p> <p>Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.</p> <p>### Details</p> <p>The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where…</p> <p><strong>Affected:</strong> Homebrew: mongo-orchestration</p> <p>### Summary</p> <p>PyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client&#39;s seed list.</p> <p>### Impact</p> <p>An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo&#39;s parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker&#39;s host, exposing credentials, or route operations to it.</p> <p>Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.</p> <p>### Patches</p> <p>Fixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.</p> <p>### Workarounds</p> <p>Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.</p> <p>### Details</p> <p>The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where…</p> https://db.gcve.eu/vuln/brew-mongo-orchestration-cve-2026-96748 https://db.gcve.eu/vuln/cve-2026-96748 <p><strong>Affected:</strong> MongoDB Python Driver</p> <p>PyMongo&#39;s connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application&#39;s database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.</p> <p><strong>Affected:</strong> MongoDB Python Driver</p> <p>PyMongo&#39;s connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application&#39;s database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.</p> https://db.gcve.eu/vuln/cve-2026-96748 https://db.gcve.eu/vuln/pysec-2026-4297 <p><strong>Affected:</strong> PyPI: pymongo</p> <p>### Summary</p> <p>PyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client&#39;s seed list.</p> <p>### Impact</p> <p>An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo&#39;s parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker&#39;s host, exposing credentials, or route operations to it.</p> <p>Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.</p> <p>### Patches</p> <p>Fixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.</p> <p>### Workarounds</p> <p>Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.</p> <p>### Details</p> <p>The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where…</p> <p><strong>Affected:</strong> PyPI: pymongo</p> <p>### Summary</p> <p>PyMongo percent-decoded the entire host section of a connection string before splitting it into individual `host:port` entries. A percent-encoded `,` or `:` in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client&#39;s seed list.</p> <p>### Impact</p> <p>An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because `%2C` and `%3A` survive most URL-safety checks and only become delimiters inside PyMongo&#39;s parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker&#39;s host, exposing credentials, or route operations to it.</p> <p>Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.</p> <p>### Patches</p> <p>Fixed in PyMongo 4.18.2. Percent-decoding was moved into `split_hosts` and now applies only to Unix domain socket paths, identified by an unescaped `.sock` suffix before decoding, and only after splitting on `,`.</p> <p>### Workarounds</p> <p>Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.</p> <p>### Details</p> <p>The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where…</p> https://db.gcve.eu/vuln/pysec-2026-4297