CVE-2026-120678
MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
- Record
CVE-2026-120678- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-03
EUVDEUVD-2026-116133
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
- Record
EUVD-2026-116133- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-03
NVD
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
- Record
CVE-2026-120678- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-120678
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
- Record
DEBIAN-CVE-2026-120678- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-120678
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
- Record
UBUNTU-CVE-2026-120678- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12437-1 No score
bson-devel-2.5.8-1.1 on GA media
These are all security issues fixed in the bson-devel-2.5.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12437-1- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mongo-c-driverDebian:12 |
All versions, plus listed versions 1.23.1-11.23.1-1+deb12u11.23.1-1+deb12u21.23.1-1+deb12u31.24.1-1 Show 45 moreShow less1.24.2-11.24.3-11.24.4-11.25.0-11.25.1-11.25.2-11.25.4-11.25.4-1.1~exp11.26.0-11.26.0-1.11.26.0-1.1~exp11.26.1-11.26.2-11.27.0-11.27.1-11.27.2-11.27.3-11.27.4-11.27.5-11.27.6-11.28.0-11.28.1-11.29.0-11.29.1-11.29.2-11.30.0-11.30.1-11.30.2-11.30.3-11.30.4-12.0.2-12.1.0-12.1.1-12.1.2-12.2.0-12.2.1-12.2.2-12.2.3-12.2.4-12.3.0-12.3.1-12.3.2-12.3.3-12.4.0-12.5.0-1 |
None known |
mongo-c-driverDebian:13 |
All versions, plus listed versions 1.30.4-11.30.4-1+deb13u11.30.4-1+deb13u21.30.4-1+deb13u32.0.2-1 Show 21 moreShow less2.1.0-12.1.1-12.1.2-12.2.0-12.2.1-12.2.2-12.2.3-12.2.4-12.3.0-12.3.1-12.3.2-12.3.3-12.4.0-12.5.0-12.5.1-12.5.2-12.5.3-12.5.5-12.5.6-12.5.7-12.5.8-1 |
None known |
mongo-c-driverDebian:14 |
All versions, plus listed versions 1.30.4-12.0.2-12.1.0-12.1.1-12.1.2-1 Show 18 moreShow less2.2.0-12.2.1-12.2.2-12.2.3-12.2.4-12.3.0-12.3.1-12.3.2-12.3.3-12.4.0-12.5.0-12.5.1-12.5.2-12.5.3-12.5.5-12.5.6-12.5.7-12.5.8-1 |
None known |
mongo-c-driverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.15.0-11.15.1-11.15.2-11.16.0-11.16.1-11.16.1-1build11.16.1-1build21.16.1-1ubuntu0.1~esm1 |
None known |
mongo-c-driverUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.18.0-11.19.1-11.19.2-11.20.0-11.20.0-1build1 Show 4 moreShow less1.20.1-11.21.0-11.21.0-1build11.21.0-1ubuntu0.1~esm1 |
None known |
mongo-c-driverUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.24.3-11.24.4-11.25.1-11.25.2-11.25.4-1 Show 4 moreShow less1.26.0-11.26.0-1.1ubuntu11.26.0-1.1ubuntu21.26.0-1.1ubuntu2+esm1 |
None known |
mongo-c-driverUbuntu:26.10 |
All versions, plus listed versions 2.2.2-12.3.1-12.3.2-12.3.3-1build12.5.0-1 |
None known |
mongo-c-driverUbuntu:26.04:LTS |
All versions, plus listed versions 1.30.4-1ubuntu12.2.0-12.2.1-12.2.2-1 |
None known |
mongo-c-driveropenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.5.8-1.1 | 2.5.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| title | CVE List, EUVD, NVD | |
| aliases, products, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-120678 is a high vulnerability (CVSS 8.7) in Mongodb C Driver, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. No source names a fixed version.
References
jira.mongodb.org/browse/CDRIVER-6521
security-tracker.debian.org/tracker/CVE-2026-120678
ubuntu.com/security/CVE-2026-120678
cve.org/CVERecord?id=CVE-2026-120678
suse.com/security/cve/CVE-2026-120678
Left out here: 7 versions. The JSON record has them.