Vulnerability in MongoDB C Driver

[ Description ]Official description

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4328

  MongoDB (EF Core Provider, Atlas SQL, C Treiber, Rust Treiber, Database Tools and Node.js Treiber): Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-119672CVE-2026-120954CVE-2026-120678+12 more CVEs

[ References ]References

• jira.mongodb.org/browse/CDRIVER-6494