DEBIAN-CVE-2026-88035

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-88035

    DEBIAN-CVE-2026-88035

    Published: 10 Sept 2026Last Modified: 11 Sept 2026
    Upstream:
    CVE-2026-88035

    Summary:

    Details: A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

    References: https://security-tracker.debian.org/tracker/CVE-2026-88035

    Affected packages

    Package

    Name: mongo-c-driver

    Purl: pkg:deb/debian/mongo-c-driver?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.23.1-1
    1.23.1-1+deb12u1
    1.23.1-1+deb12u2
    1.23.1-1+deb12u3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-88035 | CVE-DB