Vulnerability PYSEC-2026-4294
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
7 hours ago
October 15, 2026 at 10:22 AM UTC
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
0.1pre - 4.18.0
0.1pre - 4.18.0
Summary
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods
Details
Impact
When reading/writing via an ID with the GridFS API, require an exact match on the given ID. Otherwise, if a Hash is given in place of the ID, it may be interpreted as criteria, overriding the ID match.
Patches
Patch available in pymongo >= 4.18.1
Workarounds
Ensure your existing workflow only supports exact matching on the GridFS API.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 hours ago
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
0.1pre - 4.18.1 PYSEC-2026-4296
0.1pre - 4.18.1 PYSEC-2026-4296
Medium Risk
7 hours ago
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
3.5.0 - 4.18.1 PYSEC-2026-4297
3.5.0 - 4.18.1 PYSEC-2026-4297
Medium Risk
7 hours ago
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
3.9.0 - 4.18.1 PYSEC-2026-4295
3.9.0 - 4.18.1 PYSEC-2026-4295
High Risk
9 days ago
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
0.1pre - 4.18.1 GHSA-v4x9-3549-crwv
0.1pre - 4.18.1 GHSA-v4x9-3549-crwv
Medium Risk
9 days ago
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
3.5.0 - 4.18.1 GHSA-vp6j-j7w5-5xjj
3.5.0 - 4.18.1 GHSA-vp6j-j7w5-5xjj
Impacted packages
Timeline
Published
7 hours ago
October 15, 2026 at 10:22 AM UTC
Fixed (4.18.1)
1 month ago
September 10, 2026 at 02:55 PM UTC
Last Modified
2 hours ago
October 15, 2026 at 02:45 PM UTC