{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amongodbc_driver/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-120956"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["C Driver"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MongoDB"],"content_html":"\u003cp\u003eThe MongoDB C Driver lacks validation for the type and format of 'namespace' fields returned by a MongoDB server. An unauthenticated attacker-controlled MongoDB endpoint can exploit this by returning a malformed namespace value in a query response. This results in either a process termination (denial of service) or an out-of-bounds memory read, leading to the leakage of the client application's uninitialized heap memory via subsequent commands. The impact is isolated to the client application process embedding the vulnerable driver.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eConfirmed impacts include process termination (Denial of Service) and the potential exposure of sensitive data stored in uninitialized heap memory to a malicious server endpoint.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all internal applications and services that utilize the MongoDB C Driver.\u003c/li\u003e\n\u003cli\u003ePrioritize updates to the driver as soon as a patch is released by MongoDB to address the lack of input validation.\u003c/li\u003e\n\u003cli\u003eMonitor client applications for unexpected crashes or error patterns that correlate with MongoDB connectivity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T20:02:49Z","date_published":"2026-11-03T20:02:49Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-memory-disclosure/","summary":"The MongoDB C Driver fails to validate server-provided namespace fields, allowing an unauthenticated malicious MongoDB endpoint to trigger a process crash or cause the driver to disclose uninitialized heap memory.","title":"MongoDB C Driver: Out-of-bounds heap memory disclosure (CVE-2026-120956)","url":"https://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-memory-disclosure/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mongodb:mongo-c-driver:*:*:*:*:*:*:*:*","cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-120955"},{"cvss":7.5,"id":"CVE-2026-120678"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MongoDB C Driver"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","memory-leak","mongodb"],"_cs_type":"advisory","_cs_vendors":["MongoDB"],"content_html":"\u003cp\u003eThe MongoDB C Driver contains a vulnerability in the GridFS file download API where the failure to check the result of internal operations during specific error conditions can lead to process termination. An attacker capable of manipulating file download parameters can induce this condition, causing a denial of service for applications utilizing the affected driver for GridFS operations. There is currently no mention of remote code execution or authentication bypass; the impact is limited to service availability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the termination of the process utilizing the affected MongoDB C Driver API, leading to denial-of-service for the dependent application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all applications currently utilizing the MongoDB C Driver.\u003c/li\u003e\n\u003cli\u003eMonitor for application-level crashes or service restarts occurring during GridFS file retrieval operations.\u003c/li\u003e\n\u003cli\u003eApply patches or updates to the MongoDB C Driver once a remediated version is released by the vendor.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-04T00:24:51Z","date_published":"2026-11-03T20:02:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-dos/","summary":"The MongoDB C Driver fails to validate internal operation results within the GridFS file download API, allowing an attacker to trigger a process crash and service unavailability.","title":"MongoDB C Driver: GridFS file download API denial of service (CVE-2026-120955)","url":"https://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}