Ecosystem	Package	Version

Vulnerabilities

CVE-2025-14911

CVE-2025-14911

User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container.

Published Jan 28, 2026

https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/14xxx/CVE-2025-14911.json

CVSS ScoreHigh

7.1

Ecosystem	Package	Version


cargo	mongodb	0.0.1
cargo	mongodb	0.1.0
cargo	mongodb	0.1.1
cargo	mongodb	0.1.3
cargo	mongodb	0.1.4
cargo	mongodb	0.1.5
cargo	mongodb	0.1.6
cargo	mongodb	0.1.7
cargo	mongodb	0.1.8
cargo	mongodb	0.10.0
cargo	mongodb	0.11.0
cargo	mongodb	0.2.0
cargo	mongodb	0.2.1
cargo	mongodb	0.2.2
cargo	mongodb	0.2.3
cargo	mongodb	0.2.5
cargo	mongodb	0.2.6
cargo	mongodb	0.2.7
cargo	mongodb	0.2.8
cargo	mongodb	0.2.9
cargo	mongodb	0.3.0
cargo	mongodb	0.3.10
cargo	mongodb	0.3.11
cargo	mongodb	0.3.12
cargo	mongodb	0.3.1
cargo	mongodb	0.3.2
cargo	mongodb	0.3.3
cargo	mongodb	0.3.4
cargo	mongodb	0.3.5
cargo	mongodb	0.3.6
cargo	mongodb	0.3.7
cargo	mongodb	0.3.8
cargo	mongodb	0.3.9
cargo	mongodb	0.4.0
cargo	mongodb	0.9.0-alpha
cargo	mongodb	0.9.0
cargo	mongodb	0.9.1
cargo	mongodb	0.9.2
cargo	mongodb	1.0.0
cargo	mongodb	1.1.0-beta
cargo	mongodb	1.1.0
cargo	mongodb	1.1.1
cargo	mongodb	1.2.0
cargo	mongodb	1.2.1
cargo	mongodb	1.2.2
cargo	mongodb	1.2.3
cargo	mongodb	1.2.4
cargo	mongodb	1.2.5
cargo	mongodb	2.0.0-alpha.1
cargo	mongodb	2.0.0-alpha

CVE-2025-14911 | Components Impacted | Sonatype Guide | Sonatype Guide