PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Summary
PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.
Impact
An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because %2C and %3A survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.
Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.
Patches
Fixed in PyMongo 4.18.2. Percent-decoding was moved into split_hosts and now applies only to Unix domain socket paths, identified by an unescaped .sock suffix before decoding, and only after splitting on ,.
Workarounds
Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.
Details
The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where unquote_plus was applied to the whole host section in _validate_uri and, later, _parse_srv, before the string was split on , and :.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | pymongo | >= 3.5.0, < 4.18.2 | 4.18.2 |
Referencias
- https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj
- https://nvd.nist.gov/vuln/detail/CVE-2026-96748
- https://github.com/mongodb/mongo-python-driver/pull/3066
- https://github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a
- https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7
- https://github.com/mongodb/mongo-python-driver
- https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
- https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
- https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732
- https://pypi.org/project/pymongo
- https://github.com/advisories/GHSA-vp6j-j7w5-5xjj
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N- Debilidad (CWE)
CWE-177- Plataforma
- Python (PyPI)
- Paquete
pymongo- Publicada
- 05.10.2026
- Actualizado
- 15.10.2026 18:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-4297 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vp6j-j7w5-5xjj - CC BY 4.0
Historial de vulnerabilidades: pymongo
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 6
- Primera → última
- 08.2013 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
- Media 4
Divulgaciones por año
- 2017: 0
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 4
antes: 1
-
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.