Live › vulnerability › CVE-2026-120678
The MongoDB C Driver fails to release memory when handling compressed server responses, so memory grows without bound. A party controlling the database endpoint an application connects to can make that application run out of memory and become unavailable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Applications that link the MongoDB C Driver and connect to a database endpoint that an untrusted party can influence, since compressed responses from that endpoint trigger the leak. The sources do not give affected version ranges or whether compression must be enabled, so teams should confirm their driver version and connection settings.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| libmongoc | vendor | < 2.5.8 (2.x); < 1.30.15 (1.30.x); lower bound unknown | 2.5.8, 1.30.15 |
2.5.8 and 1.30.x below 1.30.15 are presumed affected; the first affected version is unknown2.5.8 (2.x line) or 1.30.15 (1.30 line); release notes list Fix a memory leak when an OP_COMPRESSED reply fails to parseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
This page as .md · .json · in your agent: get_signal("CVE-2026-120678")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.