MongoDB security advisory (AV26-1078)

Serial number: AV26-1078
Date: October 22, 2026

As of October 22, 2026, MongoDB is affected by vulnerabilities in the following product:

• C# Driver
  • Prior to 3.13.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
• Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
• MongoDB Alerts