MongoDB C Driver vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202618

Newest CVEs

• CVE-2026-120954

  Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views

  MongoDB · C Driver

  Medium6.3
• CVE-2026-120955

  MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

  MongoDB · C Driver

  High8.7
• CVE-2026-120956

  remote abort and memory disclosure from a malformed cursor.ns

  MongoDB · C Driver

  High7.1
• CVE-2026-120684

  MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password

  MongoDB · C Driver

  Medium6.0
• CVE-2026-120678

  MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

  MongoDB · C Driver

  High8.7
• CVE-2026-114645

  Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping

  MongoDB · C Driver

  Medium5.7
• CVE-2026-106438

  Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver

  MongoDB · C Driver

  Medium5.1
• CVE-2026-106437

  Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

  MongoDB · C Driver

  Medium5.9
• CVE-2026-106431

  One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver

  MongoDB · C Driver

  Medium5.9
• CVE-2026-106428

  Out-of-bounds read in SCRAM response parsing in MongoDB C Driver

  MongoDB · C Driver

  Medium6.3