CVE-2026-120956
Description
A flaw was found in mongo-c-driver. A malicious or compromised database server can return a query response containing a malformed namespace field that the client driver fails to validate. When a client application connects to the server, this issue can terminate the client process, resulting in a Denial of Service (DoS). In addition, it may cause the driver to perform an out-of-bounds memory read, potentially leaking uninitialized application memory back to the server.
Statement
A flaw was found in the MongoDB C Driver. A malicious or compromised MongoDB server can return a query response with a malformed namespace field (cursor.ns) that the client driver fails to validate, including embedded NUL bytes. This can abort the embedding client process (DoS) and can leak a small amount of uninitialized application heap memory back to the server. An attacker needs control of a MongoDB endpoint the client connects to; no credentials are required. Upstream fixed this in mongo-c-driver 1.30.15 and 2.5.8 (CDRIVER-6501). Red Hat ships mongo-c-driver only in Fedora and EPEL, where the affected versions are delegated to the community maintainers.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict type, format, and NUL-byte validation on server-returned cursor.ns fields within client applications embedding mongo-c-driver: upgrade to mongo-c-driver 1.30.15, 2.5.8 (or the fixed Mongo C Driver builds), which validate the type and format of the cursor.ns field and reject namespaces containing embedded NUL bytes, closing all 2 injection vectors (malformed cursor.ns field in query response, embedded NUL byte in server-supplied namespace string). Until patched, this is a concern on Client applications embedding mongo-c-driver connecting to untrusted or compromised MongoDB server endpoints, so Restrict client connection strings and network access exclusively to authenticated, trusted MongoDB server endpoints to avoid interacting with untrusted hosts. As a compensating measure, Enforce strict type and format allowlisting on the server-returned namespace field to reject unexpected structures and embedded NUL bytes before parsing. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing response validation and out-of-bounds read defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (medium)
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
An attacker could get secret values such as cryptographic keys, PII, memory addresses, or other information that could be used in additional attacks.
Confidentiality
Technical Impact: Bypass Protection Mechanism
Out-of-bounds memory could contain memory addresses or other information that can be used to bypass ASLR and other protection mechanisms in order to improve the reliability of exploiting a separate weakness for code execution.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker could cause a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer. This is especially likely when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string.
Other
Technical Impact: Varies by Context
The read operation could produce other undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
