CVE-2026-4359
published 2026-03-17CVE-2026-4359: A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C…
PriorityP414low3.7CVSS 3.1
AVNACHPRNUINSUCNINAL
EPSS
0.19%
8.4th percentile
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | mongo-c-driver | < mongo-c-driver 2.2.3-1 (forky) | mongo-c-driver 2.2.3-1 (forky) |
| mongodb | c_driver | < 1.30.8 | 1.30.8 |
| mongodb | c_driver | >= 2.2.0 < 2.2.3 | 2.2.3 |
| mongodb_inc | mongodb_c_driver | < 2.2.3 | 2.2.3 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.02.0LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.0LOW
vendor_debian2.0LOW
vendor_redhat2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3548-98v9-6pq6: A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the
ghsa_unreviewed·2026-03-17
CVE-2026-4359 [LOW] CWE-158 GHSA-3548-98v9-6pq6: A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
OSV
CVE-2026-4359: A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the
osv·2026-03-17·CVSS 2.0
CVE-2026-4359 [LOW] CVE-2026-4359: A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
Red Hat
mongo-c-driver: mongo-c-driver: Denial of Service via malformed HTTP response
vendor_redhat·2026-03-17·CVSS 2.0
CVE-2026-4359 [LOW] CWE-170 mongo-c-driver: mongo-c-driver: Denial of Service via malformed HTTP response
mongo-c-driver: mongo-c-driver: Denial of Service via malformed HTTP response
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
A flaw was found in mongo-c-driver. A compromised third-party cloud server or a man-in-the-middle (MITM) attacker could send a malformed HTTP response. This could cause applications using the MongoDB C driver to crash, leading to a Denial of Service.
Statement: This LOW impact vulnerability in the MongoDB C driver allows denial of service via malformed HTTP responses. Exploitation requires high complexity—either a compromised cloud server or active MITM position. Impact is limited to availability. Applications are only vulnerable when connecting
Debian
CVE-2026-4359: mongo-c-driver - A compromised third party cloud server or man-in-the-middle attacker could send ...
vendor_debian·2026·CVSS 2.0
CVE-2026-4359 [LOW] CVE-2026-4359: mongo-c-driver - A compromised third party cloud server or man-in-the-middle attacker could send ...
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.2.3-1)
sid: resolved (fixed in 2.2.3-1)
trixie: open
No detection rules found.
No public exploits indexed.
2026-03-17
Published