Heap Buffer Overflow in MongoDB C Driver Due to Unsafe String Copying

CVE-2026-6691

What is CVE-2026-6691?

The MongoDB C Driver, specifically its integration with Cyrus SASL, exhibits a vulnerability due to unsafe string copying during the canonicalization of usernames. This flaw can lead to a heap buffer overflow condition if untrusted input is utilized in the username field of a MongoDB URI configured with authMechanism=GSSAPI. Exploitations of this vulnerability may occur before any authentication procedures or network traffic is initiated, exposing systems to potential compromise.

References