---
id: "CVE-2026-120955"
kind: "vulnerability"
aliases: ["CVE-2026-120955"]
title: "MongoDB C Driver: mongoc_gridfs_bucket_download_to_stream can abort the process on invalid GridFS file metadata"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "mongo-c-driver (libmongoc)", "fixed": ["1.30.15", "2.5.8"], "affected": ">= 1.25.0, <= 1.30.14; >= 2.0.0, <= 2.5.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["c-driver", "denial-of-service", "gridfs", "libmongoc", "mongodb", "package"]
not_affected_if: ["no-gridfs-use", "no-user-controlled-download-params"]
published_at: "2026-11-03T19:18:00+00:00"
first_seen_at: "2026-11-03T19:44:52+00:00"
updated_at: "2026-11-03T19:48:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120955", "first_seen_at": "2026-11-03T19:44:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T19:48:18+00:00"}]
---

# MongoDB C Driver: mongoc_gridfs_bucket_download_to_stream can abort the process on invalid GridFS file metadata

The GridFS file download API in the MongoDB C Driver skips checking an internal result under some error conditions, which can make the process terminate. An attacker who can influence file download parameters can crash applications that use the affected API, causing service unavailability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:mongo-c-driver (libmongoc) affected >= 1.25.0, <= 1.30.14; >= 2.0.0, <= 2.5.7 fixed 1.30.15, 2.5.8

## How to check

Find the libmongoc/libbson version your app links (pkg-config --modversion libmongoc-2.0 or libmongoc-1.0, or your lockfile/vcpkg/conan manifest). Per the CVE record as relayed by HOL, versions >=1.25.0 <=1.30.14 and >=2.0.0 <=2.5.7 are affected. Then grep your code for mongoc_gridfs_bucket_download_to_stream; if absent you are not exposed. Also check if you use the other GridFS bucket download functions; the sources only name this one.

## Fix

Upgrade libmongoc to 2.5.8 (2.x line) or 1.30.15 (1.x line). Release notes: 'Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata.'

## Timeline

- 2026-11-03T19:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120955
- 2026-11-03T19:48:18+00:00 analyst — Fix 1.30.15/2.5.8 from release notes via newreleases.io mirror (GitHub releases page not yet showing them), affected range from HOL relaying the CVE record; NVD page returned nothing. Nothing marked verified: no primary page read. Authentication: CVSS 4.0 PR:N, but real exposure depends on the app. Jira CDRIVER-6494 referenced.

## Documents

- [describes] HOL Guard record for CVE-2026-120955 (quotes CVE record, ranges, CWE-476) https://hol.org/guard/security/cves/CVE-2026-120955-mongodb-c-driver-modern-gridfs
- [fix] mongo-c-driver 2.5.8 release notes (mirror of GitHub release) https://newreleases.io/project/github/mongodb/mongo-c-driver/release/2.5.8
- [fix] mongo-c-driver 1.30.15 release notes (mirror of GitHub release) https://newreleases.io/project/github/mongodb/mongo-c-driver/release/1.30.15

## From the sources

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_