CVE-2026-88035

Name of the Vulnerable Software and Affected Versions MongoDB C Driver (affected versions not specified)

Description A size check in the client-side authentication path can wrap around, allowing an unusually large user-name value to be accepted and copied past the end of a small buffer. This can lead to the application embedding the driver terminating unexpectedly. This issue occurs when the driver is built with the optional external SASL (Simple Authentication and Security Layer) authentication backend and is configured to use it. An attacker capable of modifying the driver's connection settings can trigger this condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.