CVE-2026-120955
Description
A flaw was found in the MongoDB C Driver. The GridFS file retrieval component does not properly check the results of internal operations under certain error conditions. A remote attacker who can influence file download parameters can trigger this flaw to terminate the application process, leading to a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to ensure return values are validated during GridFS stream processing in applications calling mongoc_gridfs_bucket_download_to_stream: upgrade to mongo-c-driver 1.30.15, 2.5.8 (or the fixed Mongo C Driver builds), which check the return status of internal operations during file retrieval in mongoc_gridfs_bucket_download_to_stream before continuing stream processing, closing all 2 injection vectors (malformed GridFS file metadata, crafted file download requests). Until patched, this is a concern on Applications using MongoDB C Driver GridFS download API handling untrusted download parameters or metadata, so Restrict untrusted users from controlling file download parameters or inserting malformed metadata into GridFS collections. These controls limit blast radius and contain exploitation, but they do not fix the underlying unchecked return value defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: Unexpected State; Varies by Context; DoS: Crash, Exit, or Restart
The product could be prevented from detecting unexpected states and conditions, placing the product into a state that could lead to a crash or other unintended behaviors.
Access Control
Technical Impact: Bypass Protection Mechanism
If the method/function is used for a protection mechanism, then an unchecked return value could prevent the code from being able to see if the protection mechanism fails. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
