Mongodb C Driver vulnerabilities

CVE-2026-106438 [MEDIUM] CWE-682 CVE-2026-106438: An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain ove An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause

CVE-2026-106428 [LOW] CWE-125 CVE-2026-106428: An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte

CVE-2026-4359 [LOW] CWE-158 CVE-2026-4359: A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP res A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

CVE-2025-12119 [LOW] CWE-825 CVE-2025-12119: A mongoc_bulk_operation_t may read invalid memory if large options are passed. A mongoc_bulk_operation_t may read invalid memory if large options are passed.