DEBIAN-CVE-2026-120955: High severity debian/mongo-c-driver vulnerability
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.
Affected Software
Event History
Frequently Asked Questions
What applications are exposed to this issue?
Applications using the MongoDB C Driver's GridFS file download API are exposed if an attacker can influence the parameters used for file downloads. The reported impact is process termination and resulting service unavailability.
What does an attacker need to exploit it?
An attacker needs the ability to influence GridFS file download parameters. No authentication or user interaction requirement is indicated by the supplied severity vector.
How can I determine whether my application may be affected?
Review whether the application uses the MongoDB C Driver for GridFS file retrieval and whether untrusted users or requests can affect file download parameters. The issue is triggered under certain error conditions while stream operations continue.