open-source-dependency-vulnerability

MongoDB Fixes Java Driver Use-After-Free and Laravel Query Handling Flaw

Vulnerability Disclosure · 3 sources · Updated 2mo ago · First seen Sep 11, 2026

MongoDB released fixes for two vulnerabilities affecting the Java Driver and the Laravel MongoDB PHP integration. JAVA-6276 affects Java Driver releases before 5.11.1 and is a native-heap use-after-free condition in reactive encryption, triggered when cancellation races with retrieval of Key Management Service (KMS) credentials.

PHPLARA-260 affects Laravel MongoDB versions before 5.11.0 and involves three-argument query-builder where calls that use = with an array value; the fix enforces literal equality for this condition. Organizations using the affected components should upgrade to Java Driver 5.11.1 or later and Laravel MongoDB 5.11.0 or later, and review MongoDB advisory guidance.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Sep 10, 2026 – Sep 12, 2026

Sep 12, 20262mo ago
Guyana National CIRT issues MongoDB security advisory
The Guyana National CIRT issued an advisory covering JAVA-6276 and PHPLARA-260, recommending upgrades to MongoDB Java Driver 5.11.1 or later and Laravel MongoDB 5.11.0 or later.
CIRT.GY | MongoDB Security Advisory (September 12th, 2026)
Sep 11, 20262mo ago
Canadian Cyber Centre publishes MongoDB advisory AV26-911
The Canadian Centre for Cyber Security published advisory AV26-911, directing users and administrators to review MongoDB's advisory material and apply available updates for the affected Java Driver and Laravel MongoDB products.
MongoDB security advisory (AV26-911) - Malware News - Malware Analysis, News and Indicators
Sep 10, 20262mo ago
MongoDB reports Java Driver and Laravel MongoDB vulnerabilities
MongoDB reported vulnerabilities affecting Java Driver versions before 5.11.1 and Laravel MongoDB (PHP) versions before 5.11.0. JAVA-6276 is a native-heap use-after-free caused by a cancellation race with KMS credential retrieval in reactive encryption, while PHPLARA-260 affects array-value handling in three-argument query-builder where clauses using '='.
MongoDB security advisory (AV26-911) - Malware News - Malware Analysis, News and Indicators

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Organizations

1 linked

Mongodb

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cirt GyNews · Sep 12, 2026

CIRT.GY | MongoDB Security Advisory (September 12th, 2026)Open source ↗

Malware NewsNews · Sep 11, 2026

MongoDB security advisory (AV26-911) - Malware News - Malware Analysis, News and IndicatorsOpen source ↗

Ca CcsNews · Sep 11, 2026

MongoDB security advisory (AV26-911) - Canadian Centre for Cyber SecurityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

MongoDB Fixes Java Driver Use-After-Free and Laravel Query Handling Flaw

How this story unfolded

Guyana National CIRT issues MongoDB security advisory

Canadian Cyber Centre publishes MongoDB advisory AV26-911

MongoDB reports Java Driver and Laravel MongoDB vulnerabilities

Related entities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

MongoDB fixes server and Java driver flaws including credential exposure risk

Laravel MongoDB Vulnerabilities Prompt Update Advisory for Versions Before 5.12.0

High-Severity MongoDB Driver and BI Connector Flaws Require Immediate Patching

MongoDB Fixes Java Driver Use-After-Free and Laravel Query Handling Flaw

How this story unfolded

Guyana National CIRT issues MongoDB security advisory

Canadian Cyber Centre publishes MongoDB advisory AV26-911

MongoDB reports Java Driver and Laravel MongoDB vulnerabilities

Related entities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

MongoDB fixes server and Java driver flaws including credential exposure risk

Laravel MongoDB Vulnerabilities Prompt Update Advisory for Versions Before 5.12.0

High-Severity MongoDB Driver and BI Connector Flaws Require Immediate Patching