Client-Side Authentication Buffer Overflow in MongoDB C Driver

CVE-2026-88035

What is CVE-2026-88035?

A vulnerability exists in the MongoDB C Driver relating to client-side authentication where improper size checks can lead to a buffer overflow. Specifically, if a user provides an unusually large username, it can be accepted and subsequently copied beyond the bounds of a small buffer. This misconfiguration may allow an attacker with control over the driver's connection settings to manipulate the application using the driver, potentially causing it to terminate unexpectedly. This issue is particularly concerning when the optional external SASL authentication backend is utilized.

References