CVE-2026-96748: PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client’s seed list.
References
- github.com/advisories/GHSA-vp6j-j7w5-5xjj
- github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
- github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a
- github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7
- github.com/mongodb/mongo-python-driver/pull/3066
- github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
- github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj
- nvd.nist.gov/vuln/detail/CVE-2026-96748
- www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732
Code Behaviors & Features
Detect and mitigate CVE-2026-96748 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →