mongodb/mongo-csharp-driver v3.13.0

.NET Driver Version 3.13.0 Release Notes

on GitHub

This is the general availability release for the 3.13.0 version of the driver.

Security fixes:

• CSHARP-6157 / CVE-2026-114646: NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire
  • Behavior change: writing a raw BSON document or array now throws ArgumentException if its declared length is inconsistent with the buffer. Bytes past the declared length are ignored.
• CSHARP-6162 / CVE-2026-114644: Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
  • Behavior change: BsonSymbol values are no longer interned and BsonSymbolTable is marked obsolete. Use BsonSymbol.Create or the implicit string conversion instead. Equality still compares by name; only reference identity changes.
• CSHARP-6166 / CVE-2026-114654: BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards
  • Behavior change: BsonBinaryData, the JSON reader (BinData, HexData and legacy $type) and the binary writer now reject binary subtypes outside 0 to 255.
• CSHARP-6168 / CVE-2026-114652: Update operator injection via single-element list rewriting in the update builder
  • Behavior change: PushEach and AddToSetEach with a single value now always render $each, and PullAll with a single value now always renders $pullAll. Previously a single value was unwrapped or rendered as $pull.
• CSHARP-6170 / CVE-2026-114651: Cross-document data leak via malformed BSON array parsing in reused thread buffer
• CSHARP-6174 / CVE-2026-114653: Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
  • Behavior change: the PatternProperty overload that takes a field expression is now obsolete; use Property to configure a specific field. Field names passed to PatternProperty are now matched both as literal field names and as regular expressions.
• CSHARP-6179 / CVE-2026-114643: Geometry override via duplicate-key BSON injection through GeoJSON extra members
  • Behavior change: GeoJSON serialization now throws BsonSerializationException when an extra member has the same name as a declared member.
• CSHARP-6180 / CVE-2026-114650: Plaintext exposure of encrypted fields via ANSI code-page corruption of database name
  • Behavior change: automatic encryption now passes the database name to libmongocrypt as UTF-8 instead of the Windows ANSI code page, so databases with non-ASCII names match schema map namespaces correctly.
• CSHARP-6181 / CVE-2026-114648: Query redirection via unvalidated string keys spliced into LINQ filter field paths
  • Behavior change: LINQ translation now throws NotSupportedException for dictionary keys, BsonDocument keys and Mql.Field names that the server would reinterpret: names containing ".", names starting with "$" at the start of a path, and positional operators.
• CSHARP-6184 / CVE-2026-114649: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
  • Behavior change: client certificate comparison in SslSettings, which decides whether clients share a cluster, now compares the full certificate (SHA-256 hash) and whether a private key is present, instead of only issuer and serial number.
• CSHARP-6186 / CVE-2026-114647: NoSQL operator injection via unvalidated replacement document in findOneAndReplace
  • Behavior change: FindOneAndReplace now throws ArgumentException when the first element name of the replacement document starts with $, consistent with ReplaceOne.

Improvements:

• CSHARP-5030: Only modify TCP buffer sizes if explicitly configured

Fixes:

• CSHARP-6237: LINQ Concat throws NullReferenceException when the second queryable has no pipeline stages
• CSHARP-6257: Fix WithTransaction not retrying TransientTransactionError when MongoClientSettings is created with its constructor
• CSHARP-6220: Prevent cancellation-token retention in pre-.NET 6 WaitAsync

Maintenance:

• CSHARP-6225: Latest server binary downloads require private S3
• CSHARP-6263: Fix incorrect XML doc summaries for PullAll and Pop update builders

The full list of issues resolved in this release is available at CSHARP JIRA project.

Documentation on the .NET driver can be found here.