MongoDB security advisory (AV26-1024)

Serial Number: AV26-1024Date: October 9, 2026 As of October 8, 2026, MongoDB is affected by vulnerabilities in the following products: Go Driver Prior to 2.9.0 Prior to 2.9.2 libmongocrypt Prior to 1.20.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Duplicate masterKey field re-parses into the same KEK Reject int32 length overflow in bsoncore.valueLength Reject BSON lengths below the 5-byte minimum before slicing MongoDB Alerts