MongoDB C Driver: GridFS file download API denial of service (CVE-2026-120955)
The MongoDB C Driver fails to validate internal operation results within the GridFS file download API, allowing an attacker to trigger a process crash and service unavailability.
CVE search metadata
CVE search record: CVE-2026-120955. Severity: high. CVSS: 7.5. KEV: no. Product: MongoDB C Driver. Brief: MongoDB C Driver: GridFS file download API denial of service (CVE-2026-120955). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-dos/
CVE search record: CVE-2026-120678. Severity: high. CVSS: 7.5. KEV: no. Product: MongoDB C Driver. Brief: MongoDB C Driver: GridFS file download API denial of service (CVE-2026-120955). Brief link: https://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-dos/
Triage facts
Revision 2- Applicability
- MongoDB C Driver
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 4, 00:26 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
Revision history 1 entry · Revision 2
- Revision 2
added coverage for MongoDB C Driver
Changed: action_plan, cpes, cves, lastmod, references, tags, updates
Sources: 1
The MongoDB C Driver contains a vulnerability in the GridFS file download API where the failure to check the result of internal operations during specific error conditions can lead to process termination. An attacker capable of manipulating file download parameters can induce this condition, causing a denial of service for applications utilizing the affected driver for GridFS operations. There is currently no mention of remote code execution or authentication bypass; the impact is limited to service availability.
Impact
Successful exploitation results in the termination of the process utilizing the affected MongoDB C Driver API, leading to denial-of-service for the dependent application.
Recommendation
- Inventory all applications currently utilizing the MongoDB C Driver.
- Monitor for application-level crashes or service restarts occurring during GridFS file retrieval operations.
- Apply patches or updates to the MongoDB C Driver once a remediated version is released by the vendor.
Immediate actions
Identify applications using MongoDB C Driver and prepare for patching.
Identify and inventory applications relying on MongoDB C Driver
Threat Hunt
Monitor application logs for frequent crashes or unexpected termination of processes using the MongoDB C Driver during GridFS operations.
Data: Application error logs, OS system event logs (Windows Event ID 1000, Linux core dumps)
Identify applications exhibiting sudden, sustained, or unbounded memory growth (Resident Set Size) correlated with network activity to MongoDB nodes
Data: Application performance monitoring (APM) metrics, System-level memory telemetry (e.g., Linux /proc/[pid]/stat or Windows Process object), Network connection logs to MongoDB endpoints
Mitigations
Update to the patched version of MongoDB C Driver as released by the vendor.
CVE-2026-120955
Upgrade MongoDB C Driver to a version containing the fix for CVE-2026-120678
CVE-2026-120678