CVE-2026-96746: Heap buffer overflow via mid-scan command list growth in client topology monitoring
An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the MongoDB C Driver are exposed when an unauthenticated party can control DNS/name resolution and the responses from hosts named in the application's MongoDB connection string.
Does exploitation require valid MongoDB credentials or user interaction?
No. The supplied vector indicates no privileges and no user interaction are required, but exploitation has high attack complexity because the attacker must control both name resolution and responses from connection-string hosts.
What is the likely impact if exploitation succeeds?
The out-of-bounds heap write may cause the application using the driver to terminate unexpectedly. The reported impact also includes high availability impact and low integrity impact, with no confidentiality impact.
Which releases should be reviewed for fixes?
Review the MongoDB C Driver release information for versions 1.30.12 and 2.5.5, which are referenced for this issue.