Vulnerability in MongoDB C Driver

[ Description ]Official description

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3830

  MongoDB Treiber: Multiple vulnerabilities Translated from German

  CVE-2026-106435CVE-2026-106434CVE-2026-106429+10 more CVEs

[ References ]References

• jira.mongodb.org/browse/CDRIVER-6370