---
id: "CVE-2026-120956"
kind: "vulnerability"
aliases: ["CVE-2026-120956"]
title: "MongoDB C Driver: malformed server namespace field crashes client and leaks heap memory"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "libmongoc", "fixed": ["1.30.15", "2.5.8"], "affected": ">= 1.25.0, <= 1.30.14 || >= 2.0.0, <= 2.5.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["c", "libmongoc", "mongodb", "package", "self-hosted"]
not_affected_if: ["no-c-driver", "trusted-endpoints-only"]
published_at: "2026-11-03T19:18:00+00:00"
first_seen_at: "2026-11-03T19:44:52+00:00"
updated_at: "2026-11-03T19:48:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120956", "first_seen_at": "2026-11-03T19:44:52+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T19:48:26+00:00"}]
---

# MongoDB C Driver: malformed server namespace field crashes client and leaks heap memory

The MongoDB C Driver does not check the type or format of a namespace field in query responses. A malicious or impersonated MongoDB endpoint can send a malformed value that crashes the client process, reads memory outside a buffer, and returns a small amount of the application's uninitialized heap memory to the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:libmongoc affected >= 1.25.0, <= 1.30.14 || >= 2.0.0, <= 2.5.7 fixed 1.30.15, 2.5.8

## How to check

Find which libmongoc your app uses: run 'pkg-config --modversion libmongoc-1.0' (or 'libmongoc-2.0' for 2.x), or check mongoc_get_version() / the vendored copy in your build. Affected per an aggregator: 1.25.0 to 1.30.14 and 2.0.0 to 2.5.7. Also check apps that bundle libmongoc through other wrappers (e.g. language drivers built on the C driver) and look at which MongoDB endpoints they connect to.

## Fix

Upgrade libmongoc to 2.5.8 (2.x line) or 1.30.15 (1.x line). The release notes list a matching fix but do not name this CVE; confirm against CDRIVER-6501.

## Timeline

- 2026-11-03T19:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120956
- 2026-11-03T19:48:26+00:00 analyst — No MongoDB advisory page found (GHSA list has none for this CVE; Jira CDRIVER-6501 needs login). Release notes for libmongoc 2.5.8 and 1.30.15 (read via newreleases.io mirror of GitHub releases) list 'Fix abort when parsing a cursor namespace without a dot separator', which matches but does not cite the CVE. Affected range >=1.25.0 <=1.30.14 and >=2.0.0 <=2.5.7 comes from the HOL aggregator only. Nothing verified. To settle: the CDRIVER-6501 ticket or the GitHub release text naming the CVE.

## Documents

- [fix] mongo-c-driver 2.5.8 release notes (mirror of GitHub release) https://newreleases.io/project/github/mongodb/mongo-c-driver/release/2.5.8
- [fix] mongo-c-driver 1.30.15 release notes (mirror of GitHub release) https://newreleases.io/project/github/mongodb/mongo-c-driver/release/1.30.15
- [mentions] HOL Guard record for CVE-2026-120956 (aggregator; cites CDRIVER-6501) https://hol.org/guard/security/cves/CVE-2026-120956-remote-abort-and-memory-disclosure-from-a

## From the sources

The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_