GitHub Advisoryadvisory · crates.io

GHSA-3p6w-gv5g-xjw9 MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

HIGH Published 2025-10-13 Modified 2025-10-13 Official page ↗
Aliases
CVE-2025-11695
Ecosystem
crates.io
Packages
mongodb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2025-10-13

Affected packages

• crates.io mongodb: < 3.2.5 → fixed in 3.2.5

Description

When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5.

Related

Alias · CVE (1)

  • CVE-2025-11695 When tlsInsecure=False appears in a connection string, certificate validation is disabled. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References