CVE Feed

    Dashboard / CVE / CVE-2026-120678

    CVE-2026-120678

    A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

    Published:Nov 3, 2026
    Last Modified:Nov 3, 2026
    EPS:Nov 3, 2026
    EPSS Score:
    CVSS Score:7.5

    Affected Products

    Vendor
    Mongodb
    Product
    C Driver

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-120954 (CVSS 6.3) — A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wrapar…
    CVE-2026-120955 (CVSS 8.7) — The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under …
    CVE-2026-120956 (CVSS 7.1) — The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a que…
    CVE-2026-120684 (CVSS 6) — A memory-initialization flaw in the legacy GridFS file handling of the MongoDB C Driver can cause uninitialize…
    CVE-2026-114645 (CVSS 5.7) — A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause…
    CVE-2026-106438 (CVSS 5.1) — An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precisio…
    CVE-2026-106437 (CVSS 5.9) — The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON mi…
    CVE-2026-106431 (CVSS 5.9) — An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediate…
    CVE-2026-106428 (CVSS 6.3) — An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyon…
    CVE-2026-96746 (CVSS 8.3) — An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High