GeoJSON Handling Flaw in MongoDB C# Driver

CVE-2026-114643

What is CVE-2026-114643?

The MongoDB C# Driver contains a flaw in its management of GeoJSON data, allowing extra members to be written without validation against reserved GeoJSON member names like 'type' and 'coordinates.' This oversight can lead to the creation of documents that contain duplicate geometry fields. Consequently, discrepancies arise as the MongoDB server and the C# driver might interpret the same record differently, potentially resulting in data that becomes unreadable through the driver. This vulnerability poses a risk to applications that rely on user-defined field names within GeoJSON, disrupting normal operation and causing unexpected behavior.

References