{"id":"CVE-2026-120955","kind":"vulnerability","aliases":["CVE-2026-120955"],"related":[],"title":"MongoDB C Driver: mongoc_gridfs_bucket_download_to_stream can abort the process on invalid GridFS file metadata","description":"The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.","summary":"The GridFS file download API in the MongoDB C Driver skips checking an internal result under some error conditions, which can make the process terminate. An attacker who can influence file download parameters can crash applications that use the affected API, causing service unavailability.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mongo-c-driver (libmongoc)","fixed":["1.30.15","2.5.8"],"affected":">= 1.25.0, <= 1.30.14; >= 2.0.0, <= 2.5.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["c-driver","denial-of-service","gridfs","libmongoc","mongodb","package"],"not_affected_if":["no-gridfs-use","no-user-controlled-download-params"],"how_to_check":"Find the libmongoc/libbson version your app links (pkg-config --modversion libmongoc-2.0 or libmongoc-1.0, or your lockfile/vcpkg/conan manifest). Per the CVE record as relayed by HOL, versions >=1.25.0 <=1.30.14 and >=2.0.0 <=2.5.7 are affected. Then grep your code for mongoc_gridfs_bucket_download_to_stream; if absent you are not exposed. Also check if you use the other GridFS bucket download functions; the sources only name this one.","fix":"Upgrade libmongoc to 2.5.8 (2.x line) or 1.30.15 (1.x line). Release notes: 'Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata.'","status":"open","published_at":"2026-11-03T19:18:00+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","triaged_at":"2026-11-03T19:45:26+00:00","updated_at":"2026-11-03T19:48:18+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-03T19:45:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"MongoDB C Driver: GridFS download error crashes the host process","impact":"medium","summary":"The GridFS file download API in the MongoDB C Driver skips checking an internal result under some error conditions, which can make the process terminate. An attacker who can influence file download parameters can crash applications that use the affected API, causing service unavailability.","audience":"developers","category":"package","nicknames":[],"who_cares":["mongodb","c-driver","gridfs","libmongoc"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Process terminates, causing denial of service for the application","analyst_note":"Find the affected and fixed version ranges for the MongoDB C Driver from the NVD entry or the MongoDB advisory, and confirm whether the attack needs an authenticated user.","how_to_check":"- Check the installed MongoDB C Driver version (for example with `pkg-config --modversion libmongoc-1.0`) and compare it against the affected ranges.\n- Look for applications that call GridFS download functions and accept file names or download parameters from users.","plain_action":"","needs_analyst":true,"not_affected_if":["no-gridfs-use","no-user-controlled-download-params"],"who_is_affected":"Applications that link the MongoDB C Driver and use its GridFS file download API, especially where request input controls download parameters. Services that never call GridFS downloads, or that do not pass user input into those calls, are unlikely to be exposed. The sources do not list affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4118,"output_tokens":571,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed version ranges for the MongoDB C Driver from the NVD entry or the MongoDB advisory, and confirm whether the attack needs an authenticated user.","search":"'-120955':21A,24A '-2026':20A,23A 'abort':11A 'affect':80B,144C 'api':45B,81B,89C,145C 'applic':76B,141C 'attack':67B 'bucket':6A 'c':2A,27A,31B,49B,93C 'c-driver':30B 'caus':82B,113C 'certain':105C 'check':52B,97C 'condit':59B,107C,133C 'continu':121C 'crash':75B 'cve':19A,22A 'denial':34B 'denial-of-servic':33B 'download':7A,44B,72B,88C,128C 'driver':3A,28A,32B,50B,94C 'error':58B,106C 'file':17A,43B,71B,87C,109C,127C 'gridf':5A,16A,37B,42B,86C 'influenc':70B,126C 'intern':54B,102C 'invalid':15A 'libmongoc':29A,38B 'make':62B 'may':135C 'metadata':18A 'mongo':26A 'mongo-c-driver':25A 'mongoc':4A 'mongodb':1A,39B,48B,92C 'oper':103C,120C 'packag':40B 'paramet':73B,129C 'process':13A,64B,115C 'result':55B,99C,136C 'retriev':110C 'servic':36B,83B,138C 'skip':51B 'stream':9A,119C 'termin':65B,117C 'trigger':131C 'unavail':84B,139C 'use':78B,142C 'user':123C","nicknames":[],"mitigations":[],"who_affected":"Applications that link the MongoDB C Driver (libmongoc 1.25.0 to 1.30.14, or 2.0.0 to 2.5.7) and call mongoc_gridfs_bucket_download_to_stream. The release notes tie the abort to invalid file metadata, so the trigger may be bad GridFS documents in the database rather than only caller-supplied parameters; the CVE text says a user who can influence download parameters can trigger it. Apps that do not use GridFS downloads can skip it. The CVSS vector shows no privileges required, but whether the app itself needs a login depends on how it exposes downloads.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["libmongoc","mongocdriverlibmongoc"],"ptokens":["driver","libmongoc","mongo"],"labels":["cdriver","denialofservice","gridfs","high","libmongoc","mongodb","package"],"campaign_type":null,"first_public_at":"2026-11-03T19:18:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120955","severity":null,"published_at":"2026-11-03T19:18:00+00:00","modified_at":"2026-11-03T19:18:00+00:00","first_seen_at":"2026-11-03T19:44:52+00:00","fetched_at":"2026-11-03T19:44:52+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120955:1527","url":null,"severity":null,"published_at":"2026-11-03T19:48:18+00:00","modified_at":"2026-11-03T19:48:18+00:00","first_seen_at":"2026-11-03T19:48:18+00:00","fetched_at":"2026-11-03T19:48:18+00:00","note":"Fix 1.30.15/2.5.8 from release notes via newreleases.io mirror (GitHub releases page not yet showing them), affected range from HOL relaying the CVE record; NVD page returned nothing. Nothing marked verified: no primary page read. Authentication: CVSS 4.0 PR:N, but real exposure depends on the app. Jira CDRIVER-6494 referenced."}],"documents":[{"id":60319,"url":"https://newreleases.io/project/github/mongodb/mongo-c-driver/release/2.5.8","title":"mongo-c-driver 2.5.8 release notes (mirror of GitHub release)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":60320,"url":"https://newreleases.io/project/github/mongodb/mongo-c-driver/release/1.30.15","title":"mongo-c-driver 1.30.15 release notes (mirror of GitHub release)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":60324,"url":"https://hol.org/guard/security/cves/CVE-2026-120955-mongodb-c-driver-modern-gridfs","title":"HOL Guard record for CVE-2026-120955 (quotes CVE record, ranges, CWE-476)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}