Live › vulnerability › CVE-2026-120955
The GridFS file download API in the MongoDB C Driver skips checking an internal result under some error conditions, which can make the process terminate. An attacker who can influence file download parameters can crash applications that use the affected API, causing service unavailability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 19:44 UTC. All times on this page are UTC.
Applications that link the MongoDB C Driver (libmongoc 1.25.0 to 1.30.14, or 2.0.0 to 2.5.7) and call mongoc_gridfs_bucket_download_to_stream. The release notes tie the abort to invalid file metadata, so the trigger may be bad GridFS documents in the database rather than only caller-supplied parameters; the CVE text says a user who can influence download parameters can trigger it. Apps that do not use GridFS downloads can skip it. The CVSS vector shows no privileges required, but whether the app itself needs a login depends on how it exposes downloads.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mongo-c-driver (libmongoc) | vendor | >= 1.25.0, <= 1.30.14; >= 2.0.0, <= 2.5.7 | 1.30.15, 2.5.8 |
1.25.0 <=1.30.14 and >= <= are affected2.0.02.5.72.5.8 (2.x line) or 1.30.15 (1.x line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.
This page as .md · .json · in your agent: get_signal("CVE-2026-120955")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.