CVE-2026-114643 MongoDB CVE debrief

Who should care

Defenders responsible for MongoDB C# Driver deployments, particularly those using user-supplied field names in GeoJSON extra members, should assess exposure and prioritize verification and updates.

Why it matters

Defenders should prioritize verifying and updating MongoDB C# Driver versions due to the potential for data inconsistencies and application interruptions. Limited information is available on potential exploits or affected systems, emphasizing the need for caution and verification.

• Potential data inconsistencies due to duplicate geometry fields
• Interruption of application code that reads affected records
• Need for verification and updates to MongoDB C# Driver versions
• Possible issues with data readability and usability

Technical summary

The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, causing the server and driver to resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them. This vulnerability affects MongoDB C# Driver versions prior to 3.13.0.

Defensive priority

Defenders should prioritize verifying and updating MongoDB C# Driver versions to 3.13.0 or later, and review application code that uses user-supplied field names in GeoJSON extra members.

Recommended defensive actions

• Verify and update MongoDB C# Driver versions to 3.13.0 or later
• Review application code that uses user-supplied field names in GeoJSON extra members
• Monitor for potential issues with duplicate geometry fields in stored documents
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploits or affected systems. Defenders should verify and update MongoDB C# Driver versions to 3.13.0 or later and review application code that uses user-supplied field names in GeoJSON extra members. Limited information is available on potential exploits or affected systems, emphasizing the need for caution and verification. The CVE Program record and NIST NVD detail page provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.