MONGODB C Driver

• CVE-2026-120954 Low 3.7 Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views 0.2%
• CVE-2026-120955 High 7.5 MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata 0.4%
• CVE-2026-120956 High 7.1 remote abort and memory disclosure from a malformed cursor.ns 0.3%
• CVE-2026-120684 Medium 6.5 MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password 0.3%
• CVE-2026-120678 High 7.5 MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service) 0.4%
• CVE-2026-114645 Medium 5.2 Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping 0.2%
• CVE-2026-106438 Medium 4.0 Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver 0.1%
• CVE-2026-106437 Medium 6.2 Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver 0.1%
• CVE-2026-106431 Medium 5.7 One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver <0.1%
• CVE-2026-106428 Low 3.7 Out-of-bounds read in SCRAM response parsing in MongoDB C Driver 0.2%
• CVE-2026-96746 Medium 6.5 Heap buffer overflow via mid-scan command list growth in client topology monitoring 0.4%
• CVE-2026-88036 High 8.3 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver 0.3%
• CVE-2026-88035 Medium 4.7 Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver 0.1%
• CVE-2026-84963 Medium 5.3 Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser 0.3%
• CVE-2026-84964 Medium 5.9 Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client 0.3%
• CVE-2026-84965 Medium 5.1 Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds 0.1%
• CVE-2026-84969 Low 3.7 Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output 0.3%
• CVE-2026-81524 Medium 5.4 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver 0.3%
• CVE-2025-12119 Medium 6.8 Bulk write with options may read invalid memory 0.2%