{"id":"CVE-2026-120678","kind":"vulnerability","aliases":["CVE-2026-120678"],"related":[],"title":"MongoDB C Driver: compressed responses leak memory, exhausting client applications","description":"A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.","summary":"The MongoDB C Driver fails to release memory when handling compressed server responses, so memory grows without bound. A party controlling the database endpoint an application connects to can make that application run out of memory and become unavailable.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"libmongoc","fixed":["2.5.8","1.30.15"],"affected":"< 2.5.8 (2.x); < 1.30.15 (1.30.x); lower bound unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["c","libmongoc","mongodb","package","self-hosted"],"not_affected_if":["compression-disabled","no-untrusted-endpoint"],"how_to_check":"Check the libmongoc version your application links against (mongoc_get_version() or pkg-config --modversion libmongoc-1.0 / mongoc2). 2.x below 2.5.8 and 1.30.x below 1.30.15 are presumed affected; the first affected version is unknown. Exposure needs compression enabled in the connection (the compressors= URI option, zlib/zstd/snappy) and a server that sends malformed OP_COMPRESSED replies. Without compressors in the URI, the compressed-reply path should not be used (inferred, not stated by MongoDB).","fix":"Upgrade libmongoc to 2.5.8 (2.x line) or 1.30.15 (1.30 line); release notes list 'Fix a memory leak when an OP_COMPRESSED reply fails to parse'. Release notes do not name the CVE; the match is by the CVE title.","status":"open","published_at":"2026-11-03T19:17:59+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","triaged_at":"2026-11-03T19:45:25+00:00","updated_at":"2026-11-03T19:48:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T19:45:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MongoDB C Driver: compressed responses leak memory, exhausting client applications","impact":"medium","summary":"The MongoDB C Driver fails to release memory when handling compressed server responses, so memory grows without bound. A party controlling the database endpoint an application connects to can make that application run out of memory and become unavailable.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongodb","c","libmongoc","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application memory grows without limit until the application becomes unavailable","analyst_note":"Find the affected and fixed libmongoc version ranges and whether compression must be enabled, from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-120678) or the MongoDB advisory.","how_to_check":"- Check whether the application uses the MongoDB C Driver (libmongoc) by looking for `libmongoc` in build files or package manifests.\n- Check the installed driver version, for example `pkg-config --modversion libmongoc-1.0`; the sources do not name affected version ranges.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-endpoint"],"who_is_affected":"Applications that link the MongoDB C Driver and connect to a database endpoint that an untrusted party can influence, since compressed responses from that endpoint trigger the leak. The sources do not give affected version ranges or whether compression must be enabled, so teams should confirm their driver version and connection settings.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4142,"output_tokens":593,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed libmongoc version ranges and whether compression must be enabled, from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-120678) or the MongoDB advisory.","search":"'-120678':13A,16A '-2026':12A,15A 'applic':10A,50B,56B,102C,113C,119C 'becom':62B,120C 'bound':42B 'c':2A,18B,27B,71C 'caus':79C,106C 'client':9A,81C,101C 'compress':4A,35B,76C 'connect':51B,103C 'control':45B,96C 'credenti':123C 'cve':11A,14A 'databas':47B,98C 'driver':3A,28B,72C 'endpoint':48B,99C 'exhaust':8A 'fail':29B 'flaw':67C 'grow':40B 'growth':110C 'handl':34B,74C 'hold':84C 'host':24B 'interact':129C 'leak':6A 'libmongoc':17A,19B 'librari':82C 'make':54B 'manag':66C 'may':78C,105C,115C 'memori':7A,32B,39B,60B,65C,87C,109C 'mongodb':1A,20B,26B,70C 'never':90C 'packag':21B 'parti':44B,94C 'releas':31B,91C 'repeat':107C 'requir':131C 'respons':5A,37B,77C 'result':116C 'run':57B 'secur':125C 'self':23B 'self-host':22B 'server':36B 'set':126C 'transport':124C 'unauthent':93C 'unavail':63B,121C 'unbound':108C 'user':128C 'without':41B","nicknames":[],"mitigations":[],"who_affected":"Applications that link the MongoDB C Driver and connect to a database endpoint that an untrusted party can influence, since compressed responses from that endpoint trigger the leak. The sources do not give affected version ranges or whether compression must be enabled, so teams should confirm their driver version and connection settings.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["libmongoc"],"ptokens":["libmongoc"],"labels":["c","high","libmongoc","mongodb","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T19:17:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120678","severity":null,"published_at":"2026-11-03T19:17:59+00:00","modified_at":"2026-11-03T19:17:59+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120678:1528","url":null,"severity":null,"published_at":"2026-11-03T19:48:02+00:00","modified_at":"2026-11-03T19:48:02+00:00","first_seen_at":"2026-11-03T19:48:02+00:00","fetched_at":"2026-11-03T19:48:02+00:00","note":"Fix found only via GitHub release notes (via newreleases.io mirror; GitHub tag page not fetchable) for 2.5.8 and 1.30.15. NVD page returned empty and no MongoDB advisory was found, so the affected lower bound is unknown and nothing is marked verified. HOL says CVSS 8.7. X was not queried."}],"documents":[{"id":60319,"url":"https://newreleases.io/project/github/mongodb/mongo-c-driver/release/2.5.8","title":"mongo-c-driver 2.5.8 release notes (mirror of GitHub release)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":60320,"url":"https://newreleases.io/project/github/mongodb/mongo-c-driver/release/1.30.15","title":"mongo-c-driver 1.30.15 release notes (mirror of GitHub release)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":60321,"url":"https://hol.org/guard/security/cves/CVE-2026-120678-mongo-c-driver-leaks-the-decompressed-reply","title":"HOL Guard record CVE-2026-120678","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}