PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Summary
PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.
Impact
An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because %2C and %3A survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.
Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.
Patches
Fixed in PyMongo 4.18.2. Percent-decoding was moved into split_hosts and now applies only to Unix domain socket paths, identified by an unescaped .sock suffix before decoding, and only after splitting on ,.
Workarounds
Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.
Details
The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where unquote_plus was applied to the whole host section in _validate_uri and, later, _parse_srv, before the string was split on , and :.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | pymongo | >= 3.5.0, < 4.18.2 | 4.18.2 |
References
- https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj
- https://nvd.nist.gov/vuln/detail/CVE-2026-96748
- https://github.com/mongodb/mongo-python-driver/pull/3066
- https://github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a
- https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7
- https://github.com/mongodb/mongo-python-driver
- https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
- https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
- https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732
- https://pypi.org/project/pymongo
- https://github.com/advisories/GHSA-vp6j-j7w5-5xjj
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N- Weakness (CWE)
CWE-177- Platform
- Python (PyPI)
- Package
pymongo- Disclosed
- 05.10.2026
- Updated
- 15.10.2026 18:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-4297 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vp6j-j7w5-5xjj - CC BY 4.0
Vulnerability history: pymongo
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 08.2013 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 4
Disclosures per year
- 2017: 0
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 4
earlier: 1
-
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.