CVE-2026-120956

Name	CVE-2026-120956
Description	The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mongo-c-driver (PTS)	bookworm	1.23.1-1+deb12u3	vulnerable
	trixie	1.30.4-1+deb13u3	vulnerable
	forky	2.5.7-1	vulnerable
	sid	2.5.8-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mongo-c-driver	source	(unstable)	2.5.8-1

Notes

[trixie] - mongo-c-driver <no-dsa> (Minor issue)
https://jira.mongodb.org/browse/CDRIVER-6501
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/bdab7de9432389b214ba695fa7067c4c413a1900 (2.5.8)
Additionally depends on CDRIVER-6401 fix: https://github.com/mongodb/mongo-c-driver/commit/8f8274cd301a6e70d5eefccfac1b35ac2ed43c92 (2.5.6)
Fixed by: https://github.com/mongodb/mongo-c-driver/commit/4fdc5d553801fcde7bd5c86370917cc4ac704f54 (1.30.15)
Additionally depends on CDRIVER-6401 fix: https://github.com/mongodb/mongo-c-driver/commit/9e5423f882089c2fbede5cafd5a1fee1bab58780 (1.30.15)