Vulnerability in MongoDB C Driver

[ Description ]Official description

An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

[ Fixes ]Fixes and patches

• Security bulletin: MongoDB GHSA-frjf-h5jg-4v46Vendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-qx36-8mw2-4r3xVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-vp6j-j7w5-5xjjVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB 3579Vendor patch or bulletin · CERT-FR · github.com/mongodb/laravel-mongodb/pull/3579, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB v1.49.12Vendor patch or bulletin · CERT-FR · github.com/mongodb-js/compass/releases/tag/v1.49.12, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-cmvj-vxvq-rh2cVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq, cited by CERT-FR CERTFR-2026-AVI-1234
• Security bulletin: MongoDB GHSA-v4x9-3549-crwvVendor patch or bulletin · CERT-FR · github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3, cited by CERT-FR CERTFR-2026-AVI-1234

[ Advisories ]Government CERT advisories

• CERT-FR28 Sep 2026CERTFR-2026-AVI-1234

  Multiple vulnerabilities in MongoDB Translated from French

  Multiple vulnerabilities have been discovered in MongoDB. They allow an attacker to cause a breach of data integrity, a security policy bypass and a security problem not specified by the vendor.

  CVE-2026-96745CVE-2026-96748CVE-2026-96747+2 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3583

  MongoDB Treiber (Python Driver, PHP Driver, C Driver, Compass and Laravel): Multiple vulnerabilities Translated from German

  CVE-2026-96744CVE-2026-96745CVE-2026-96750+4 more CVEs

[ References ]References

• github.com/mongodb/mongo-c-driver/releases/tag/1.30.12
• github.com/mongodb/mongo-c-driver/releases/tag/2.5.5
• github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46