PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Summary
PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.
Impact
An application that interpolates untrusted input into a MongoDB connection string -- for example, a tenant name or hostname fragment taken from a request -- could be made to add an attacker-controlled server to the seed list. Because %2C and %3A survive most URL-safety checks and only become delimiters inside PyMongo's parser, input that looks like a single hostname to the application becomes two hosts to the driver. The client may then perform topology discovery and authentication against the attacker's host, exposing credentials, or route operations to it.
Unix domain socket paths, the only host identifiers that legitimately require percent-encoding, are not affected.
Patches
Fixed in PyMongo 4.18.2. Percent-decoding was moved into split_hosts and now applies only to Unix domain socket paths, identified by an unescaped .sock suffix before decoding, and only after splitting on ,.
Workarounds
Do not interpolate untrusted input into the host portion of a connection string. If unavoidable, reject or percent-decode-and-validate the value before building the URI.
Details
The decoding was introduced in PyMongo 3.5.0 (PYTHON-1282), where unquote_plus was applied to the whole host section in _validate_uri and, later, _parse_srv, before the string was split on , and :.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Python (PyPI) | pymongo | >= 3.5.0, < 4.18.2 | 4.18.2 |
Odnośniki
- https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj
- https://nvd.nist.gov/vuln/detail/CVE-2026-96748
- https://github.com/mongodb/mongo-python-driver/pull/3066
- https://github.com/mongodb/mongo-python-driver/commit/1e7a56db4649b14c4c9a6ac20aa4a8d0d1bb238a
- https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7
- https://github.com/mongodb/mongo-python-driver
- https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst
- https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2
- https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732
- https://pypi.org/project/pymongo
- https://github.com/advisories/GHSA-vp6j-j7w5-5xjj
- Wektor CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N- Słabość (CWE)
CWE-177- Platforma
- Python (PyPI)
- Paczka
pymongo- Ujawniono
- 05.10.2026
- Aktualizacja
- 15.10.2026 18:17
Źródła i licencje
OSV / GitHub Advisory Database - PYSEC-2026-4297 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vp6j-j7w5-5xjj - CC BY 4.0
Historia podatności: pymongo
Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 6
- Pierwsza → ostatnia
- 08.2013 10.2026
- Bez poprawki
- 0
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 2
- Średnia 4
Ujawnienia w latach
- 2017: 0
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 4
wcześniej: 1
-
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.