Out-of-bounds read in MongoDB driver for C - CVE-2026-106428
Published: October 25, 2026
Vulnerability identifier: #VU157650
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-106428
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by terminating an application using the MongoDB C Driver.
The vulnerability exists due to an out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver when processing a malformed server-final message. A remote attacker can supply this message through a server or network intermediary before server-signature verification to trigger a read one byte beyond a fixed-size buffer and terminate the application.
The extra byte read is not returned through the protocol.
Affected software
MongoDB driver for C
Fedora
mongo-c-driver
Fedora
mongo-c-driver
How to mitigate CVE-2026-106428
Install security update from vendor's website.
MongoDB driver for C - addressed in versions 1.30.13, 2.4.0
mongo-c-driver - addressed in versions 1.30.13-1.el8, 1.30.13-1.el9, 1.30.13-1.el10_2, 1.30.13-1.fc43, 1.30.13-1.fc44
mongo-c-driver - addressed in versions 1.30.13-1.el8, 1.30.13-1.el9, 1.30.13-1.el10_2, 1.30.13-1.fc43, 1.30.13-1.fc44