[
https://issues.apache.org/jira/browse/FLINK-40713?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ferenc Csaky closed FLINK-40713.
--------------------------------
Fix Version/s: mongodb-3.0.0
Assignee: Purushottam Sinha
Resolution: Fixed
[{{a85f0b6}}|https://github.com/apache/flink-connector-mongodb/commit/a85f0b63bf4d5518a14370aebf919fa306c81cfc]
in main
> Bump mongo-driver version from 5.1.1 to 5.11.1 to fix CVE-2026-88033
> --------------------------------------------------------------------
>
> Key: FLINK-40713
> URL: https://issues.apache.org/jira/browse/FLINK-40713
> Project: Flink
> Issue Type: Improvement
> Components: Connectors / MongoDB
> Reporter: Purushottam Sinha
> Assignee: Purushottam Sinha
> Priority: Major
> Labels: pull-request-available
> Fix For: mongodb-3.0.0
>
>
> {{mongodb-driver-sync}} 5.1.1 is affected by CVE-2026-88033 (High, CVSS 8.3)
> — a GridFS query-injection flaw allowing an authenticated user to read/delete
> file content outside their target, or hijack a rename. Fixed in 5.11.1.
> Breaking change: driver ≥5.5 drops MongoDB Server 4.0 support. Verified
> directly — a live MongoDB 4.0.28 server is rejected with
> {{MongoIncompatibleDriverException}} (needs wire version 8 / MongoDB 4.2+).
> This ticket also moves the {{mongodb4}} CI profile forward accordingly.
> Verified against the full current server range: 5.8–5.11 gets a full check
> from 4.2 through 8.3 per the driver's compatibility matrix, and live tests
> against 4.4.30, 8.0.29, and 8.0.32 all pass (insert/find/count/aggregate).
> Also needed for full MongoDB 8.x support — 5.1.1 only gets partial
> compatibility there. A follow-up ticket adds the {{mongodb8}} CI profile once
> this lands.
> Changes:
> * {{mongodb.driver.version}} 5.1.1 → 5.11.1
> * {{mongodb4.version}} 4.0.28 → 4.4.30
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
