Boletim de segurança de 5 de outubro de 2026

CVE-2026-96748

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

pip · pymongo

PyMongo percent-decoded the entire host section of a connection string before splitting it into individual host:port entries. A percent-encoded , or : in a hostname therefore decoded into a real delimiter, injecting an additional attacker-chosen host and port into the client's seed list.