PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

[ Description ]Official description

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

[ Fixes ]Fixes and patches

• pymongo 4.18.2Fixed version · GitHub Advisories · pip package pymongo: upgrade to 4.18.2 or later (affected >= 3.5.0, <= 4.18.1)
• Security bulletin: MongoDB GHSA-frjf-h5jg-4v46Vendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-qx36-8mw2-4r3xVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-vp6j-j7w5-5xjjVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB 3579Vendor patch or bulletin · CERT-FR · github.com/mongodb/laravel-mongodb/pull/3579, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB v1.49.12Vendor patch or bulletin · CERT-FR · github.com/mongodb-js/compass/releases/tag/v1.49.12, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-cmvj-vxvq-rh2cVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-v4x9-3549-crwvVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3, cited by CERT-FR CERTFR-2026-AVI-1234

[ Advisories ]Government CERT advisories

• CERT-FR28 Sep 2026CERTFR-2026-AVI-1234

  Multiple vulnerabilities in MongoDB Translated from French

  Multiple vulnerabilities have been discovered in MongoDB. They allow an attacker to cause a breach of data integrity, a security policy bypass and a security problem not specified by the vendor.

  CVE-2026-96745CVE-2026-96748CVE-2026-96747+2 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3583

  MongoDB Treiber (Python Driver, PHP Driver, C Driver, Compass and Laravel): Multiple vulnerabilities Translated from German

  CVE-2026-96744CVE-2026-96745CVE-2026-96750+4 more CVEs

[ Packages ]Affected open-source packages

• pymongo pipAffected >= 3.5.0, <= 4.18.1 · fixed in 4.18.2 · GHSA-vp6j-j7w5-5xjj

[ References ]References

• github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
• github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
• github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj