PT-2026-37642 · Mongodb+1 · Mongodb C Driver+1
CVE-2026-6691
·
Published
2025-10-22
·
Updated
2026-07-28
CVSS v4.0
8.6
High
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
mongo-c-driver (affected versions not specified)
Description
The Cyrus SASL integration in the MongoDB C Driver performs unsafe string copying during username canonicalization. This flaw enables a heap buffer overflow—a condition where data exceeds the allocated memory buffer on the heap—before any authentication or network traffic occurs. The issue can be triggered by providing untrusted input in the username of a MongoDB URI when using the
authMechanism=GSSAPI parameter. This may allow a remote attacker to cause a denial of service.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Os
Mongodb C Driver