Cpe:2.3:a:mongodb:mongo-C-Driver:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amongodbmongo-c-driver/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 20:02:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMongoDB C Driver: GridFS file download API denial of service (CVE-2026-120955)https://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-dos/Tue, 03 Nov 2026 20:02:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mongodb-c-driver-dos/The MongoDB C Driver fails to validate internal operation results within the GridFS file download API, allowing an attacker to trigger a process crash and service unavailability.The MongoDB C Driver contains a vulnerability in the GridFS file download API where the failure to check the result of internal operations during specific error conditions can lead to process termination. An attacker capable of manipulating file download parameters can induce this condition, causing a denial of service for applications utilizing the affected driver for GridFS operations. There is currently no mention of remote code execution or authentication bypass; the impact is limited to service availability.

Impact

Successful exploitation results in the termination of the process utilizing the affected MongoDB C Driver API, leading to denial-of-service for the dependent application.

Recommendation

  1. Inventory all applications currently utilizing the MongoDB C Driver.
  2. Monitor for application-level crashes or service restarts occurring during GridFS file retrieval operations.
  3. Apply patches or updates to the MongoDB C Driver once a remediated version is released by the vendor.
]]>lowadvisorydenial-of-servicememory-leakmongodb