SB2026102515 - Fedora EPEL 8 update for mongo-c-driver
Published: October 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Incorrect calculation (CVE-ID: CVE-2026-106438)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause an application to store or use an incorrect numeric value.
The vulnerability exists due to an incorrect exactness calculation in the MongoDB C Driver Decimal128 string parser when processing over-precision decimal strings containing leading zeros. A remote attacker can supply a crafted decimal string to an embedding application, including through Extended JSON parsing, to cause the parser to accept a value different from the supplied text instead of rejecting the input.
2) Integer underflow (CVE-ID: CVE-2026-106437)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service, read adjacent process memory, or corrupt adjacent process memory.
The vulnerability exists due to unsigned integer underflow in the MongoDB C Driver BSON buffer-reservation API when append or comparison operations process a document with a recorded length below the five-byte BSON minimum. A remote attacker can influence the length an embedding application supplies to bson_reserve_buffer to trigger out-of-bounds reads or writes during subsequent affected operations, causing application termination or access to adjacent process memory.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-106431)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt adjacent process memory or cause a denial of service.
The vulnerability exists due to a one-byte heap-based buffer overflow caused by an off-by-one error in the MongoDB C Driver BSON bulk document writer when serializing documents that end at a specific buffer boundary. A remote attacker can influence the size of documents serialized by an embedding application using the BSON bulk-writer API to cause a zero byte to be written immediately past a heap allocation, corrupting adjacent process memory or terminating the process.
4) Out-of-bounds read (CVE-ID: CVE-2026-106428)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by terminating an application using the MongoDB C Driver.
The vulnerability exists due to an out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver when processing a malformed server-final message. A remote attacker can supply this message through a server or network intermediary before server-signature verification to trigger a read one byte beyond a fixed-size buffer and terminate the application.
The extra byte read is not returned through the protocol.
Remediation
Install update from vendor's website.