MongoDB C# Driver GeoJSON Member Collision Vulnerability

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: MongoDB, Inc.

Description

The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-114643

Affected Vendors & Products

Vendor	Product	Version / Range
MongoDB	C# Driver	1.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-694	The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Attack-Flow Graph

Executive Summary

The MongoDB C# Driver allows writing GeoJSON extra members without checking for name collisions with reserved GeoJSON fields like type and coordinates. This can lead to documents with duplicate geometry fields, causing the server and driver to interpret different values for the same record. Some records may become unreadable through the driver, disrupting application functionality.

Impact Analysis

This vulnerability can cause data corruption or loss by making records unreadable through the driver. Applications relying on consistent data interpretation may fail or produce incorrect results. It may also lead to unexpected behavior when handling GeoJSON data with user-supplied field names.

Mitigation Strategies

Update the MongoDB C# Driver to the latest version to ensure the vulnerability is patched. Review any applications using the driver to avoid storing user-supplied field names in GeoJSON extra members.

Hi! I’m here to help you understand CVE-2026-114643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70