CVE-2026-106428: Out-of-bounds read in SCRAM response parsing in MongoDB C Driver
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using the MongoDB C Driver during SCRAM authentication are exposed if a server or network intermediary can supply a malformed server-final message before server-signature verification.
What does an attacker need to exploit it?
An attacker needs the ability to provide or alter the SCRAM server-final authentication message before the driver verifies the server signature. The issue does not require privileges or user interaction, but exploitation has high attack complexity.
What is the expected impact?
A malformed message can cause the application using the driver to terminate. The out-of-bounds byte is not returned through the protocol, and the provided impact data indicates no confidentiality or integrity impact.