---
id: "CVE-2026-120678"
kind: "vulnerability"
aliases: ["CVE-2026-120678"]
title: "MongoDB C Driver: compressed responses leak memory, exhausting client applications"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "libmongoc", "fixed": ["2.5.8", "1.30.15"], "affected": "< 2.5.8 (2.x); < 1.30.15 (1.30.x); lower bound unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["c", "libmongoc", "mongodb", "package", "self-hosted"]
not_affected_if: ["compression-disabled", "no-untrusted-endpoint"]
published_at: "2026-11-03T19:17:59+00:00"
first_seen_at: "2026-11-03T19:44:52+00:00"
updated_at: "2026-11-03T19:48:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120678", "first_seen_at": "2026-11-03T19:44:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T19:48:02+00:00"}]
---

# MongoDB C Driver: compressed responses leak memory, exhausting client applications

The MongoDB C Driver fails to release memory when handling compressed server responses, so memory grows without bound. A party controlling the database endpoint an application connects to can make that application run out of memory and become unavailable.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:libmongoc affected < 2.5.8 (2.x); < 1.30.15 (1.30.x); lower bound unknown fixed 2.5.8, 1.30.15

## How to check

Check the libmongoc version your application links against (mongoc_get_version() or pkg-config --modversion libmongoc-1.0 / mongoc2). 2.x below 2.5.8 and 1.30.x below 1.30.15 are presumed affected; the first affected version is unknown. Exposure needs compression enabled in the connection (the compressors= URI option, zlib/zstd/snappy) and a server that sends malformed OP_COMPRESSED replies. Without compressors in the URI, the compressed-reply path should not be used (inferred, not stated by MongoDB).

## Fix

Upgrade libmongoc to 2.5.8 (2.x line) or 1.30.15 (1.30 line); release notes list 'Fix a memory leak when an OP_COMPRESSED reply fails to parse'. Release notes do not name the CVE; the match is by the CVE title.

## Timeline

- 2026-11-03T19:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120678
- 2026-11-03T19:48:02+00:00 analyst — Fix found only via GitHub release notes (via newreleases.io mirror; GitHub tag page not fetchable) for 2.5.8 and 1.30.15. NVD page returned empty and no MongoDB advisory was found, so the affected lower bound is unknown and nothing is marked verified. HOL says CVSS 8.7. X was not queried.

## Documents

- [fix] mongo-c-driver 2.5.8 release notes (mirror of GitHub release) https://newreleases.io/project/github/mongodb/mongo-c-driver/release/2.5.8
- [fix] mongo-c-driver 1.30.15 release notes (mirror of GitHub release) https://newreleases.io/project/github/mongodb/mongo-c-driver/release/1.30.15
- [mentions] HOL Guard record CVE-2026-120678 https://hol.org/guard/security/cves/CVE-2026-120678-mongo-c-driver-leaks-the-decompressed-reply

## From the sources

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_