File Download API Vulnerability in MongoDB C Driver
CVE-2026-120955

8.7HIGH

Key Information:

Vendor

Mongodb
Status
C Driver
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120955?

The GridFS file download API in the MongoDB C Driver is vulnerable due to insufficient error handling during file retrieval operations. Under specific error conditions, the failure to check the results of internal operations can lead to process termination, which may affect applications relying on this functionality. Attackers with the ability to influence file download parameters could exploit this flaw, potentially resulting in application downtime and degraded service availability.

Affected Version(s)

C Driver 1.25.0 <= 1.30.14

C Driver 2.0.0 <= 2.5.7

References

https://jira.mongodb.org/browse/CDRIVER-6494

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.