Namespace Validation Flaw in MongoDB C Driver

CVE-2026-120956

What is CVE-2026-120956?

The MongoDB C Driver has a namespace field validation issue that allows a MongoDB endpoint, which does not require authentication, to return malformed data in query responses. This can lead to process termination of the client application and potentially allow the driver to access memory beyond allocated buffers. As a consequence, there is a risk of uninitialized heap memory being sent back to the endpoint in subsequent commands, impacting the overall security and stability of applications utilizing the driver.

References