CVE-2026-120955

The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.

• CWE-476

• https://jira.mongodb.org/browse/CDRIVER-6494

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120931Out of bounds write in WebGL in Google Chrome on on Android …9.6
• CVE-2026-12094The Advanced Contact Form 7 - Compact DB plugin for WordPres…5.3
• CVE-2026-12095The Kargo Takip plugin for WordPress is vulnerable to Server…7.2
• CVE-2026-120952An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver …7.1
• CVE-2026-120953A URI redirection weakness exists in the authentication comp…4.3
• CVE-2026-120954A weakness in the BSON library's handling of a specialized b…3.7
• CVE-2026-120956The MongoDB C Driver does not validate the type or format of…7.1
• CVE-2026-120959A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver …3.7
• CVE-2026-12097The User Management plugin for WordPress is vulnerable to au…5.3
• CVE-2026-120971A flaw was found in RESTEasy's default exception mapper. Whe…5.3
• CVE-2026-12098The PowerPress Podcasting plugin by Blubrry plugin for WordP…6.4
• CVE-2026-120987Whale Browser before 5.39.412.57 allows an attacker to bypas…