{ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://percona.github.io/percona-server-mongodb/vex/percona-server-mongodb-8.3.7-1.openvex.json", "author": "Percona Security ", "timestamp": "2026-07-28T16:54:00Z", "version": 1, "statements": [ { "vulnerability": { "name": "CVE-2026-33186" }, "products": [ { "@id": "pkg:github/grpc/grpc@v1.74.1" } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "CVE-2026-33186 affects grpc-go (pkg:golang/google.golang.org/grpc), a separate repository. The vulnerable HTTP/2 :path handling and the authz RBAC engine do not exist in the vendored C++ implementation. NVD CPE grpc:grpc cannot distinguish language implementations.", "timestamp": "2026-07-27T19:22:37.25964Z" }, { "vulnerability": { "name": "CVE-2019-14249" }, "products": [ { "@id": "pkg:github/davea42/libdwarf-code@libdwarf-2.1.0" } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "CVE-2019-14249 is a division-by-zero DoS in dwarf_elf_load_headers.c when parsing an ELF with a zero-size SHT_GROUP section, fixed upstream 2019-07-05 (pre-0.4.1). Vendored libdwarf 2.1.0 postdates the fix by years and already contains the corrected bounds checks. Additionally, libdwarf is only a transitive dev-only dependency of cpptrace, gated behind dev_stacktrace_enabled and target_compatible_with excluding release builds, so it is never present in distributed binaries.", "timestamp": "2026-07-28T00:00:00Z" }, { "vulnerability": { "name": "CVE-2020-27545" }, "products": [ { "@id": "pkg:github/davea42/libdwarf-code@libdwarf-2.1.0" } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "CVE-2020-27545 is a one-byte out-of-bounds read in the libdwarf line-table parser via a crafted object file, fixed upstream in release 20201017. Vendored libdwarf 2.1.0 postdates the fix by years. Additionally, libdwarf is only a transitive dev-only dependency of cpptrace, gated behind dev_stacktrace_enabled and target_compatible_with excluding release builds, so it is never present in distributed binaries.", "timestamp": "2026-07-28T00:00:00Z" }, { "vulnerability": { "name": "CVE-2020-28163" }, "products": [ { "@id": "pkg:github/davea42/libdwarf-code@libdwarf-2.1.0" } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "CVE-2020-28163 is a null-pointer dereference crash when printing a DWARF5 line-table header with an invalid FORM for a pathname, fixed upstream 2020-12-01. Vendored libdwarf 2.1.0 postdates the fix by years. Additionally, libdwarf is only a transitive dev-only dependency of cpptrace, gated behind dev_stacktrace_enabled and target_compatible_with excluding release builds, so it is never present in distributed binaries.", "timestamp": "2026-07-28T00:00:00Z" }, { "vulnerability": { "name": "CVE-2022-41409" }, "products": [ { "@id": "pkg:github/pcre2project/pcre2@pcre2-10.40" } ], "status": "under_investigation", "status_notes": "Vendored pcre2 is 10.40 (fixed in 10.41); the vulnerable stack-overflow-via-deeply-nested-parentheses path in pcre2_compile.c is present in-tree at src/third_party/pcre2. PSMDB compiles user-supplied patterns through this code via the mongo::pcre::Regex wrapper (src/mongo/util/pcre.h/.cpp), reached from the $regex match expression (src/mongo/db/matcher/expression_leaf.cpp), aggregation $regexMatch/$regexFind/$regexFindAll (src/mongo/db/exec/expression/evaluate_regex.cpp), the SBE regex path (src/mongo/db/exec/sbe/util/pcre.cpp), and JSON Schema pattern/patternProperties validation (json_schema_parser.cpp). No explicit PCRE2 parentheses-nesting-depth limit is set by the wrapper (mongo::pcre::Limits only exposes heapLimitKB/matchLimit), so exposure depends on whether other server-side bounds (e.g. BSON/query size limits, JIT/match limits) already prevent sufficiently deep nesting from reaching the vulnerable compile path. This needs confirmation before a not_affected/affected determination can be made; tracking an upgrade to pcre2 >= 10.41 in the meantime.", "timestamp": "2026-07-28T00:00:00Z" }, { "vulnerability": { "name": "CVE-2026-6231" }, "products": [ { "@id": "pkg:github/mongodb/mongo-c-driver@1.28.1" } ], "status": "affected", "action_statement": "This vulnerability is only reachable through the Queryable Encryption (QE) / FLE2 payload and key-document parsing path. If your deployment does not use Queryable Encryption, this CVE has no impact and no action is required. If your deployment does use Queryable Encryption, treat this as an outstanding risk until a fixed libbson import ships in a future Percona Server for MongoDB release.", "impact_statement": "CVE-2026-6231 is a flaw in libbson's bson_validate()/bson_validate_with_error() family where validation could return early on certain crafted inputs and incorrectly report success, letting malformed BSON or invalid UTF-8 bypass validation. It affects mongo-c-driver < 1.30.5 and 2.0.0-2.0.1, fixed in 1.30.5 and 2.0.2. On the v8.3 branch, src/third_party/libbson/import.sh pins VERSION=1.28.1, confirmed as the newest entry in the vendored libbson NEWS file -- this predates the 1.30.5 fix, so the flaw is present in-tree. PSMDB's own server-side BSON validator (src/mongo/bson/bson_validate.cpp) is an independent implementation that does not call into libbson, but the vendored bson_validate()/bson_validate_with_error() functions are reachable via src/third_party/libmongocrypt (12 call sites, e.g. mongocrypt.c, mc-fle2-*.c, mongocrypt-marking.c, mongocrypt-key.c, mongocrypt-buffer.c), which mongod invokes for Queryable Encryption / FLE2 payload and key-document parsing (src/mongo/crypto/fle_util.cpp). Deployments using Queryable Encryption are therefore exposed to malformed/invalid-UTF-8 BSON bypassing validation in that path; deployments without QE enabled do not exercise this code.", "timestamp": "2026-07-28T00:00:00Z" }, { "vulnerability": { "name": "CVE-2025-12119" }, "products": [ { "@id": "pkg:github/mongodb/mongo-c-driver@1.28.1" } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "CVE-2025-12119 (CWE-825, expired pointer dereference) is in mongoc_bulk_operation_t in libmongoc -- the mongo-c-driver client-driver component -- when large options are passed to a bulk write; it affects mongo-c-driver 1.9.0-1.30.5 and 2.0.0-2.1.1, fixed in 1.30.6 and 2.1.2. On v8.3, as on other branches, PSMDB vendors only the libbson component of the mongo-c-driver monorepo (src/third_party/libbson, pinned to 1.28.1 per import.sh); libmongoc, and mongoc_bulk_operation_t specifically, is not vendored, built, or referenced anywhere in the tree (no src/third_party/libmongoc directory, no callers under src/mongo or src/third_party/libmongocrypt). This finding is independent of the vendored libbson version -- the affected client-driver code simply is not part of this codebase.", "timestamp": "2026-07-28T00:00:00Z" }, { "vulnerability": { "name": "CVE-2026-4359" }, "products": [ { "@id": "pkg:github/mongodb/mongo-c-driver@1.28.1" } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "CVE-2026-4359 is a crash triggerable by a malformed HTTP response from a compromised or MITM'd cloud/KMS endpoint, handled by libmongoc's HTTP client (used for cloud KMS/OIDC metadata requests) -- the mongo-c-driver client-driver component. It affects mongo-c-driver < 2.2.3 (and < 1.30.8 on the 1.x line), fixed in 2.2.3 and 1.30.8. On v8.3, as on other branches, PSMDB vendors only the libbson component of the mongo-c-driver monorepo (src/third_party/libbson, pinned to 1.28.1 per import.sh); libmongoc's HTTP client is not vendored or built anywhere in the tree. This finding is independent of the vendored libbson version -- the affected client-driver code simply is not part of this codebase.", "timestamp": "2026-07-28T00:00:00Z" } ] }