{
  "cveId": "CVE-2026-81524",
  "url": "https://patchblox.com/security/cve/CVE-2026-81524",
  "summary": "CVE-2026-81524 is fixed in mongo-c-driver on 1 platform, first by DEBIAN-CVE-2026-81524, released September 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "mongo-c-driver: A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components...",
  "description": "A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that incorporates untrusted input into these name components can have operations directed at a resource other than the one intended.",
  "published": "2026-08-27T20:18:50Z",
  "severity": "",
  "epss": 0.00267,
  "epssPercentile": 0.18891,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "mongo-c-driver",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.30.4-1\u002Bdeb13u3",
      "fix": "DEBIAN-CVE-2026-81524",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-81524",
      "released": "2026-09-03T01:35:34Z"
    },
    {
      "platform": "linux",
      "product": "mongo-c-driver",
      "release": "Debian 14",
      "fixedVersion": "2.5.1-1",
      "fix": "DEBIAN-CVE-2026-81524",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-81524",
      "released": "2026-09-03T01:35:34Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}