GHSA-3p6w-gv5g-xjw9

MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

Source: GitHub Advisory Database (reviewed) High CVE-2025-11695

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	mongodb	< 3.2.5	3.2.5

Details

As written in the advisory (Markdown source, shown as plain text).

When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-11695 advisory
https://github.com/mongodb/mongo-rust-driver/pull/1453 web
https://github.com/mongodb/mongo-rust-driver/commit/21ed6aeeea386628621b36a6af2a1a248cc87dcf web
https://github.com/mongodb/mongo-rust-driver/commit/b918cd6676331c45f26dd1acd13e230aaf17fe6d web
https://github.com/mongodb/mongo-rust-driver package
https://jira.mongodb.org/browse/RUST-2264 web