MongoDB C Driver advisory flags information leak and crash flaws
VULNERABILITYMongoDBredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
MongoDB advisory AV26-1122 (4 November 2026) affects the MongoDB C Driver prior to 1.30.15 and prior to 2.5.8. Issues are: failure to parse OPCOMPRESSED reply can leak (information disclosure), and mongocgridfsbucketdownloadtostream may abort on bad metadata (denial of service). No CVE identifiers are given in the advisory. Defenders should inventory applications linking libmongoc and upgrade to 1.30.15 or 2.5.8 or later, then check the linked MongoDB alerts.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether applications use the MongoDB C Driver, including through language bindings or other software.
- Upgrade the MongoDB C Driver to version 1.30.15 or later in the 1.x line, or 2.5.8 or later in the 2.x line.
- Review the MongoDB alerts linked in the advisory for further detail.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Canadian Centre for Cyber Security
Who and what is in it
Companies