{"id":"GHSA-3p6w-gv5g-xjw9","summary":"MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string","details":"When tlsInsecure=False appears in a connection string, certificate validation is disabled.\n\nThis vulnerability affects MongoDB Rust Driver versions prior to v3.2.5.","aliases":["CVE-2025-11695"],"modified":"2025-10-13T21:13:14.404300Z","published":"2025-10-13T18:31:13Z","database_specific":{"nvd_published_at":"2025-10-13T17:15:34Z","cwe_ids":["CWE-295"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-10-13T20:38:21Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11695"},{"type":"WEB","url":"https://github.com/mongodb/mongo-rust-driver/pull/1453"},{"type":"WEB","url":"https://github.com/mongodb/mongo-rust-driver/commit/21ed6aeeea386628621b36a6af2a1a248cc87dcf"},{"type":"WEB","url":"https://github.com/mongodb/mongo-rust-driver/commit/b918cd6676331c45f26dd1acd13e230aaf17fe6d"},{"type":"PACKAGE","url":"https://github.com/mongodb/mongo-rust-driver"},{"type":"WEB","url":"https://jira.mongodb.org/browse/RUST-2264"}],"affected":[{"package":{"name":"mongodb","ecosystem":"crates.io","purl":"pkg:cargo/mongodb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-3p6w-gv5g-xjw9/GHSA-3p6w-gv5g-xjw9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"}]}