CVE catalog

CVE-2026-88035

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able t

[CVE catalog]

Severity
Medium · CVSS 5.7CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.10% · Oct 23, 2026

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmongo-c-driversid2.5.7-1fixed
Debianmongo-c-driverforky2.5.6-1fixed
Debianmongo-c-drivertrixie1.30.4-1+deb13u3vulnerable
Debianmongo-c-driverbookworm1.23.1-1+deb12u3vulnerable
Cpec_driverNot reported2.5.3fixed
Ubuntumongodbpro1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu2vulnerable
Ubuntumongodbpro1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5vulnerable
Ubuntumongodbpro1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.2vulnerable
Ubuntumongodbpro1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3vulnerable
Ubuntumongodbpro1:3.6.9+really3.6.8+90~g8e540c0b6d-0ubuntu5.3+esm1vulnerable
Opensusemongo-c-drivertumbleweed2.5.3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmongo-c-driversourcesid2.5.3-1not yet assignedNot reportedNot reported
Debianmongo-c-driversourceforky2.5.3-1not yet assignedNot reportedNot reported
Debianmongo-c-driversourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianmongo-c-driversourcebookworm(unfixed)not yet assignedNot reportedNot reported
Cpec_drivercpeNot reported2.5.3Not reportedNVD-CVE-2026-88035Not reported
Opensusemongo-c-driverrpmtumbleweed2.5.3-1.1Not reportedOPENSUSE-SU-2026:11767-1Not reported

Notes

[trixie] mongo-c-driver: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libbson-1.0-0]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.23.1-1+deb12u3 · amd64 · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

    • 1.23.1-1+deb12u3 · arm64 · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

  • [libbson-dev]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.23.1-1+deb12u3 · amd64 · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

    • 1.23.1-1+deb12u3 · arm64 · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

  • [libbson-doc]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.23.1-1+deb12u3 · all · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

    • 1.23.1-1+deb12u3 · all · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

  • [libmongoc-1.0-0]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.23.1-1+deb12u3 · amd64 · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

    • 1.23.1-1+deb12u3 · arm64 · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

  • [libmongoc-dev]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.23.1-1+deb12u3 · amd64 · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

    • 1.23.1-1+deb12u3 · arm64 · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

  • [libmongoc-doc]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.23.1-1+deb12u3 · all · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

    • 1.23.1-1+deb12u3 · all · bookworm

      Affected

      nvd · mongo-c-driver · debian · bookworm; nvd · mongo-c-driver · debian · 12

[Debian 13 (Trixie)]

  • [libbson-1.0-0t64]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.30.4-1+deb13u2 · amd64 · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

    • 1.30.4-1+deb13u2 · arm64 · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

  • [libbson-dev]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.30.4-1+deb13u2 · amd64 · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

    • 1.30.4-1+deb13u2 · arm64 · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

  • [libbson-doc]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.30.4-1+deb13u2 · all · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

    • 1.30.4-1+deb13u2 · all · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

  • [libmongoc-1.0-0t64]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.30.4-1+deb13u2 · amd64 · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

    • 1.30.4-1+deb13u2 · arm64 · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

  • [libmongoc-dev]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.30.4-1+deb13u2 · amd64 · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

    • 1.30.4-1+deb13u2 · arm64 · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

  • [libmongoc-doc]Affected

    Source package: [mongo-c-driver]

    Details (2)

    • 1.30.4-1+deb13u2 · all · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

    • 1.30.4-1+deb13u2 · all · trixie

      Affected

      nvd · mongo-c-driver · debian · 13

[openSUSE Tumbleweed]

  • [bson-devel]Unknown

    Source package: [mongo-c-driver]

    Details (1)

    • 2.4.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.5.3-1.1

      Version impact unknown

      nvd · mongo-c-driver · opensuse · tumbleweed

  • [libbson2]Unknown

    Source package: [mongo-c-driver]

    Details (1)

    • 2.4.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.5.3-1.1

      Version impact unknown

      nvd · mongo-c-driver · opensuse · tumbleweed

  • [libmongoc2]Unknown

    Source package: [mongo-c-driver]

    Details (1)

    • 2.4.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.5.3-1.1

      Version impact unknown

      nvd · mongo-c-driver · opensuse · tumbleweed

  • [mongo-c-driver-devel]Unknown

    Source package: [mongo-c-driver]

    Details (1)

    • 2.4.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.5.3-1.1

      Version impact unknown

      nvd · mongo-c-driver · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]