CVE-2026-120956

A flaw was found in mongo-c-driver. A malicious or compromised database server can return a query response containing a malformed namespace field that the client driver fails to validate. When a client application connects to the server, this issue can terminate the client process, resulting in a...

CVE-2026-120678 MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth i...

CVE-2026-120678

The MongoDB C Driver contains a memory management flaw related to the handling of compressed responses . Specifically, the driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse. This flaw allows an unauthenticated party controlling the database endpoint to trigger ...

[SECURITY] Fedora 45 Update: mongo-c-driver-2.5.6-1.fc45

mongo-c-driver is a client library written in C for MongoDB...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146974)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146974 advisory. An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146977)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146977 advisory. The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146985)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146985 advisory. A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146968)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146968 advisory. An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146971)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146971 advisory. An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146983)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146983 advisory. Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifie...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146973 advisory. A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the en...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146972)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146972 advisory. A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146969)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146969 advisory. An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over- precision inputs containing leading zeros instead of rejecting...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146981)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146981 advisory. An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146965)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146965 advisory. A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary...

CVE-2026-114645

A flaw was found in mongo-c-driver. An integer wraparound in the Windows-native Kerberos authentication code can occur when an excessively long credential value is supplied in the client connection configuration. An attacker capable of modifying this client configuration can cause the driver to...

OESA-2026-4446 mongo-c-driver security update

mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fixes: An out-of-bounds read in SCRAM authentication response parsing in...

OESA-2026-4445 mongo-c-driver security update

mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fixes: An out-of-bounds read in SCRAM authentication response parsing in...

OESA-2026-4444 mongo-c-driver security update

mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fixes: An out-of-bounds read in SCRAM authentication response parsing in...

OESA-2026-4443 mongo-c-driver security update

mongo-c-driver is a project that includes two libraries: libmongoc, a client library written in C for MongoDB. libbson, a library providing useful routines related to building, parsing, and iterating BSON documents. Security Fixes: An out-of-bounds read in SCRAM authentication response parsing in...