DEBIAN-CVE-2026-120956: High severity debian/mongo-c-driver vulnerability
The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Client applications that embed the MongoDB C Driver and connect to a MongoDB endpoint are exposed if that endpoint can return a malformed namespace field in a query response. The impact is limited to the process embedding the driver.
Does an attacker need credentials to trigger the issue?
No. A MongoDB endpoint that the client application connects to can return the malformed value without needing credentials.
What can exploitation cause?
The client process can terminate. The driver may also read beyond an allocated buffer and send a small amount of uninitialized heap memory from the application back to the endpoint in a follow-up command.
How can I tell whether an application may be affected?
Identify applications that embed the MongoDB C Driver and connect to MongoDB endpoints. The provided information does not include affected versions, fixed versions, or a specific detection method.