CVE catalog

CVE-2026-88031

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query con

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.48% · Oct 25, 2026

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-mongodb-mongo-driversid1.17.9+ds1-1vulnerable
Debiangolang-mongodb-mongo-driverforky1.17.9+ds1-1vulnerable
Debiangolang-mongodb-mongo-drivertrixie1.17.1+ds1-2vulnerable
Debiangolang-mongodb-mongo-driverbookworm1.8.4+ds1-3vulnerable
Cpego_driverNot reported2.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-mongodb-mongo-driversourcesid(unfixed)not yet assignedNot reported[1147410]
Debiangolang-mongodb-mongo-driversourceforky(unfixed)not yet assignedNot reported[1147410]
Debiangolang-mongodb-mongo-driversourcetrixie(unfixed)not yet assignedNot reported[1147410]
Debiangolang-mongodb-mongo-driversourcebookworm(unfixed)not yet assignedNot reported[1147410]
Cpego_drivercpeNot reported2.9.1Not reportedNVD-CVE-2026-88031Not reported

[Debian bug #1147410]

Notes

[trixie] golang-mongodb-mongo-driver: Minor issue [bookworm] golang-mongodb-mongo-driver: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-mongodb-mongo-driver-dev]Affected

    Source package: [golang-mongodb-mongo-driver]

    Details (2)

    • 1.8.4+ds1-3 · all · bookworm

      Affected

      nvd · golang-mongodb-mongo-driver · debian · bookworm; nvd · golang-mongodb-mongo-driver · debian · 12

    • 1.8.4+ds1-3 · all · bookworm

      Affected

      nvd · golang-mongodb-mongo-driver · debian · bookworm; nvd · golang-mongodb-mongo-driver · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]