CVE-2026-4359: Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4359?
CVE-2026-4359 has been assigned a severity score that indicates it poses a significant risk due to the potential for application crashes.
How do I fix CVE-2026-4359?
To fix CVE-2026-4359, update to the latest version of the MongoDB C driver where this vulnerability is patched.
What causes CVE-2026-4359?
CVE-2026-4359 is caused by a heap buffer over-read initiated by malformed HTTP responses from a compromised cloud server or a man-in-the-middle attacker.
What applications are affected by CVE-2026-4359?
Applications that utilize the MongoDB C driver are vulnerable to CVE-2026-4359 if they do not handle malformed HTTP responses appropriately.
Is there a workaround for CVE-2026-4359?
A recommended workaround for CVE-2026-4359 is to implement additional validation of HTTP responses before processing them.