C Driver

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.

Published: 2026-10-22T19:13:49.867Z
Updated: 2026-10-29T01:52:06.895Z

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Published: 2026-09-10T18:09:10.536Z
Updated: 2026-09-10T18:29:27.944Z

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

Published: 2026-09-10T18:07:10.823Z
Updated: 2026-09-10T18:29:53.256Z

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

Published: 2025-11-18T20:21:08.252Z
Updated: 2026-01-14T19:04:31.839Z

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.

Published: 2020-04-24T00:31:51.000Z
Updated: 2024-08-04T11:48:58.185Z