CVE-2026-120678
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the…
- Risk score
- 50/100
- CVSS
- 7.5 v3.1
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, wh…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
Last activity 3 Nov 2026. Patch Forecast updates every hour.