DEBIAN-CVE-2026-120678: High severity debian/mongo-c-driver vulnerability
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications using the MongoDB C Driver are exposed when they connect to a database endpoint controlled by an unauthenticated party. The issue affects the client application rather than requiring compromise of a MongoDB server.
What does an attacker need to exploit this issue?
An attacker needs control of the database endpoint that the client application connects to and must be able to send repeated compressed responses. No credentials, user interaction, or particular transport security setting is required.
What is the likely impact of successful exploitation?
Repeated malicious compressed responses can cause unbounded memory growth because memory is not released. This can exhaust the client application's available memory and make the application unavailable.