Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120956— remote abort and memory disclosure from a malformed cursor.ns

Quick assessment

Affected
MongoDB C Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB C 驱动未对查询响应中由服务器返回的命名空间字段的类型或格式进行验证。若客户端应用程序连接到一个无需任何凭据即可访问的 MongoDB 端点，该端点可返回该字段中的畸形值。这会导致客户端应用程序进程终止，同时可能使驱动程序读取已分配缓冲区之外的内存，并在后续命令中将少量应用程序自身未初始化的堆内存回传给该端点。该漏洞的影响范围仅限于嵌入该驱动的进程。

CVSS 7.1 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
MongoDB C Driver 1.25.0≤ 1.30.14 affected
2.0.0≤ 2.5.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120956

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
remote abort and memory disclosure from a malformed cursor.ns
Source: CVE Program / CVE List V5
Vulnerability Description
The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB C Driver 1.25.0 ~ 1.30.14 -

II. Public POCs for CVE-2026-120956

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120956

请登录查看更多情报信息。

Other References for CVE-2026-120956 (1)

Same Patch Batch · MongoDB · 2026-11-03 · 15 CVEs total

CVE-2026-119675 8.6 HIGH mongorestore may bypass collection guards through a system.buckets prefix
CVE-2026-120678 7.5 HIGH MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to
CVE-2026-120955 7.5 HIGH MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Applicatio
CVE-2026-120952 7.1 HIGH MongoDB Atlas SQL ODBC Driver writes 48-byte Extended JSON into fixed 16-byte SQL_C_GUID t
CVE-2026-119179 7.0 HIGH MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expo
CVE-2026-120684 6.5 MEDIUM MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password
CVE-2026-120673 5.5 MEDIUM Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command
CVE-2026-120567 5.4 MEDIUM ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions
CVE-2026-119672 4.8 MEDIUM mongofiles may disclose GridFS content to standard output through a stored filename
CVE-2026-120953 4.3 MEDIUM Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-co
CVE-2026-119674 3.7 LOW mongorestore may restore encoded collection names into an unintended collection
CVE-2026-120954 3.7 LOW Silent element-count truncation via 32-bit bit-length overflow in packed-bit vector views
CVE-2026-120959 3.7 LOW MongoDB Atlas SQL ODBC Driver uses ignored SQLBindCol BufferLength as fixed-width row-arra
CVE-2026-119673 2.8 LOW mongofiles may write outside the working directory through a symlink

IV. Related Vulnerabilities

Same product: C Driver
Same vendor: MongoDB
Same weakness: CWE-617