CVE-2026-120956 remote abort and memory disclosure from a malformed cursor.ns

The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application...

CVE-2026-120956

The MongoDB C Driver is vulnerable to a remote abort and memory disclosure because it fails to validate the type or format of the namespace field returned by a MongoDB server in a query response. If a client connects to an endpoint (without needing credentials) that returns a malformed value in t...