Alpine: mongo-c-driver: security update to 1.30.14-r0

critical Tenable Cloud Security Plugin ID 477562

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without
adequate validation. Crafted documents in a GridFS collection may cause any application that reads those
files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents
(via an out-of-bounds read). (CVE-2026-9100)

- A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response
and cause a crash in applications using the MongoDB C driver. (CVE-2026-4359)

- A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name
components to pass without sanitization when the driver composes the target namespace for an operation. An
application that incorporates untrusted input into these name components can have operations directed at a
resource other than the one intended. (CVE-2026-81524)

- An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may
cause an unusually large text value to be silently shortened, or the corresponding field to be omitted,
while the parsing operation still reports success and returns no error. An unauthenticated party who can
supply the input processed by an application that uses this component may cause that application to hold
data that does not match what was submitted, which may result in unintended alteration of data.
(CVE-2026-84963)

Solution

Update the mongo-c-driver library and its related packages to version 1.30.14-r0 or later.

Plugin Details

Severity: Critical

ID: 477562

Version: Revision 1.2

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/27/2026

Updated: 10/27/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.36

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:C

CVSS Score Source: CVE-2026-9100

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 9.2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-93393

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/4/2026

Reference Information

CVE: CVE-2026-4359, CVE-2026-81524, CVE-2026-84963, CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-88035, CVE-2026-88036, CVE-2026-9100, CVE-2026-93393

Detections

Analytics