Alert GCSA-26091 - Vulnerabilita' in MongoDB

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

   alert ID: GCSA-26091
       data: 20 maggio 2026
     titolo: Vulnerabilita' in MongoDB

******************************************************************

:: Descrizione del problema

   Sono state rilasciate nuove versioni del database MongoDB
   che risolvono varie vulnerabilita', anche di livello alto.

   Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

   MongoDB Server versioni precedenti alla 7.0.34
   MongoDB Server versioni precedenti alla 8.0.23
   MongoDB Server versioni precedenti alla 8.2.9
   MongoDB Server versioni precedenti alla 8.3.2


:: Impatto

   Denial of Service (DoS)
   Accesso a dati riservati (ID)
   Esecuzione remota di codice arbitrario (RCE)
   Bypass delle funzionalita' di sicurezza (SFB)
   Falsificazione dei dati (Spoofing)


:: Soluzione

   Aggiornare il prodotto all'ultima versione.

   https://www.mongodb.com/docs/manual/tutorial/upgrade-revision/

   Release Notes for MongoDB 8.3.2 - May 12, 2026
   https://www.mongodb.com/docs/manual/release-notes/8.3/#std-label-release-notes-8.3

   Release Notes for MongoDB 8.2.9 - May 12, 2026
   https://www.mongodb.com/docs/manual/release-notes/8.2/#std-label-release-notes-8.2


:: Riferimenti

   https://www.mongodb.com/resources/products/alerts#security

   MongoDB - Core Server Issues
   https://jira.mongodb.org/browse/SERVER-116327
   https://jira.mongodb.org/browse/SERVER-115508
   https://jira.mongodb.org/browse/SERVER-126021
   https://jira.mongodb.org/browse/SERVER-121610
   https://jira.mongodb.org/browse/SERVER-120668
   https://jira.mongodb.org/browse/SERVER-122032
   https://jira.mongodb.org/browse/SERVER-122449
   https://jira.mongodb.org/browse/SERVER-121851
   https://jira.mongodb.org/browse/SERVER-119679
   https://jira.mongodb.org/browse/SERVER-119981
   https://jira.mongodb.org/browse/CDRIVER-6134

   Mitre CVE
   https://www.cve.org/CVERecord?id=CVE-2026-8843
   https://www.cve.org/CVERecord?id=CVE-2026-8053
   https://www.cve.org/CVERecord?id=CVE-2026-8063
   https://www.cve.org/CVERecord?id=CVE-2026-6691
   https://www.cve.org/CVERecord?id=CVE-2026-8199
   https://www.cve.org/CVERecord?id=CVE-2026-8200
   https://www.cve.org/CVERecord?id=CVE-2026-8201
   https://www.cve.org/CVERecord?id=CVE-2026-8202
   https://www.cve.org/CVERecord?id=CVE-2026-8336
   https://www.cve.org/CVERecord?id=CVE-2026-8431
   https://www.cve.org/CVERecord?id=CVE-2026-6811
   https://www.cve.org/CVERecord?id=CVE-2026-6914
   https://www.cve.org/CVERecord?id=CVE-2026-6915


GARR CERT Security Alert - subscribe/unsubscribe:
https://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCag3CbgAKCRDBnEyTZRJg
Qn9oAKDA4yGE75RHYZ1QZCQhs+8Fpl2QjQCgjxH5vuc5FIWxhzvXd9HmVDe1UCQ=
=YjOw
-----END PGP SIGNATURE-----