What's Changed
Warning
Starting from driver version 3.3.0, an improper neutralization of a query operator in the GridFS delete methods allowed unintended data deletion.
See JAVA-6283 / CVE-2026-88033]
Upgrade reactive/sync driver version to 5.11.1 or later.
If you cannot upgrade, applications using older driver versions should call another delete overload delete(ObjectId). The driver constructs the BsonObjectId internally from a typed value, so no document can reach the filter.
Warning
Starting from driver version 4.2.0, cancelling or timing out an encrypted operation while the driver fetches cloud KMS credentials makes it call into freed native memory, crashing or corrupting the application.
See JAVA-6266 / CVE-2026-88032
Upgrade both reactive driver and mongodb-crypt to version 5.11.1 or later.
Full Changelog: r5.11.0...r5.11.1