Double Free Vulnerability in MongoDB C Driver Affects OpenSSL TLS Certificate Handling
CVE-2026-84964

8.2HIGH

Key Information:

Vendor

Mongodb
Status
C Driver
Vendor
CVE Published:
3 September 2026

What is CVE-2026-84964?

A double free issue has been discovered in the MongoDB C Driver that impacts the path for TLS certificate revocation checking, particularly in conjunction with OpenSSL. This can be exploited by an unauthenticated entity posing as a trusted TLS endpoint, leading to the potential for heap corruption. During the TLS handshake process, improperly formatted certificate data may cause the same heap object to be deallocated twice. As a result, this vulnerability can lead to unexpected application crashes, compromising the stability of client applications.

Affected Version(s)

C Driver 1.17.0 < 1.30.9

C Driver 2.0.0 < 2.5.2

References

https://jira.mongodb.org/browse/CDRIVER-6409

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.