Purushottam Sinha created FLINK-40713:
-----------------------------------------
Summary: Bump mongo-driver version from 5.1.1 to 5.11.1 to fix
CVE-2026-88033
Key: FLINK-40713
URL: https://issues.apache.org/jira/browse/FLINK-40713
Project: Flink
Issue Type: Improvement
Components: Connectors / MongoDB
Reporter: Purushottam Sinha
{{mongodb-driver-sync}} 5.1.1 is affected by CVE-2026-88033 (High, CVSS 8.3) —
a GridFS query-injection flaw allowing an authenticated user to read/delete
file content outside their target, or hijack a rename. Fixed in 5.11.1.
Breaking change: driver ≥5.5 drops MongoDB Server 4.0 support. Verified
directly — a live MongoDB 4.0.28 server is rejected with
{{MongoIncompatibleDriverException}} (needs wire version 8 / MongoDB 4.2+).
This ticket also moves the {{mongodb4}} CI profile forward accordingly.
Verified against the full current server range: 5.8–5.11 gets a full check from
4.2 through 8.3 per the driver's compatibility matrix, and live tests against
4.4.30, 8.0.29, and 8.0.32 all pass (insert/find/count/aggregate).
Also needed for full MongoDB 8.x support — 5.1.1 only gets partial
compatibility there. A follow-up ticket adds the {{mongodb8}} CI profile once
this lands.
Changes:
* {{mongodb.driver.version}} 5.1.1 → 5.11.1
* {{mongodb4.version}} 4.0.28 → 4.4.30
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
