CVE-2026-120956

The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.

• CWE-617

• https://jira.mongodb.org/browse/CDRIVER-6501

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12094The Advanced Contact Form 7 - Compact DB plugin for WordPres…5.3
• CVE-2026-12095The Kargo Takip plugin for WordPress is vulnerable to Server…7.2
• CVE-2026-120952An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver …7.1
• CVE-2026-120953A URI redirection weakness exists in the authentication comp…4.3
• CVE-2026-120954A weakness in the BSON library's handling of a specialized b…3.7
• CVE-2026-120955The GridFS file download API in the MongoDB C Driver does no…7.5
• CVE-2026-120959A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver …3.7
• CVE-2026-12097The User Management plugin for WordPress is vulnerable to au…5.3
• CVE-2026-120971A flaw was found in RESTEasy's default exception mapper. Whe…5.3
• CVE-2026-12098The PowerPress Podcasting plugin by Blubrry plugin for WordP…6.4
• CVE-2026-120987Whale Browser before 5.39.412.57 allows an attacker to bypas…
• CVE-2026-120988billboard.js before 4.1.3 allows an attacker to execute mali…6.1