Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MongoDB | C Driver | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://jira.mongodb.org/browse/CDRIVER-6521 |
|
Tue, 03 Nov 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required. | |
| Title | mongo-c-driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service) | |
| Weaknesses | CWE-401 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: mongodb
Published:
Updated: 2026-11-03T18:39:32.988Z
Reserved: 2026-11-02T19:09:10.643Z
Link: CVE-2026-120678
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-03T19:17:59.880
Modified: 2026-11-03T19:17:59.880
Link: CVE-2026-120678
Redhat
No data.
OpenCVE Enrichment
No data.