Is CVE-2026-114643 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114643 being exploited in the wild.

How severe is CVE-2026-114643?

Medium severity, with a CVSS score of 5.4, published 22 October 2026.

Which products and versions are affected?

MongoDB C Driver prior to 3.13.0.

Am I affected by CVE-2026-114643?

Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114643: MongoDB C# Driver GeoJSON field name collision injection

CVE-2026-114643 · Severity: medium · CVSS 5.4 · Published 2026-10-22

The MongoDB C# Driver allows applications to accept user-supplied field names in GeoJSON geometry objects without validating them against reserved fields like "type" and "coordinates". An attacker can inject fields with these reserved names, causing the driver to write duplicate keys to the database. MongoDB interprets the last occurrence of a duplicate key, allowing an attacker to silently override the geometry type or coordinates in queries or stored documents, bypassing validation and corrupting stored data.

Technologies: MongoDB C Driver. Vendors: MongoDB.

Quick answers

Is CVE-2026-114643 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114643 being exploited in the wild.
How severe is CVE-2026-114643?: Medium severity, with a CVSS score of 5.4, published 22 October 2026.
Which products and versions are affected?: MongoDB C Driver prior to 3.13.0.
Is there a fix for CVE-2026-114643?: Yes: fixed in 3.13.0. Until then: GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member (type, coordinates, bbox, or crs), preventing silent data corruption. Do not allow untrusted users to supply field names directly to GeoJsonObjectArgs.ExtraMembers.</anigation> <parameter name="attack_vector">["network"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-114643?: Check whether you run MongoDB C Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.13.0

GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member (type, coordinates, bbox, or crs), preventing silent data corruption. Do not allow untrusted users to supply field names directly to GeoJsonObjectArgs.ExtraMembers.</anigation> <parameter name="attack_vector">["network"]

Technical details

A NoSQL injection vulnerability in GeoJSON serialization: the GeoJsonObjectArgs.ExtraMembers property accepts an unvalidated BsonDocument that is stored by reference, allowing post-construction mutation. During serialization, legitimate members (type, coordinates, bbox, crs) are written first, then extra members are written last without checking for name collisions with reserved names. This produces duplicate-key BSON that MongoDB resolves using last-wins semantics, and the driver's own deserializer applies the same logic, making the injection invisible on read-back. An attacker with control over extra member keys and values can deterministically override geometry in filters or insertions.

Affected products

MongoDB C# Driver prior to 3.13.0

Timeline

2026-10-22: disclosed
2026-10-22: patched: Release v3.13.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.