CVE-2026-120678
mongo-c-driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
| CWE | CWE-401 |
| Vendor | mongodb |
| Product | c driver |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb c driver
Be the first to know when new high vulnerabilities affecting mongodb c driver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
MongoDB / C Driver
1.25.0 ≤ 1.30.14 2.0.0 ≤ 2.5.7