Read the docs
TI-2026-69707 Aliases CVE-2026-106428

Out-of-bounds read in SCRAM response parsing in MongoDB C Driver

Priority LOW 28CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The MongoDB C Driver from 1.1.0 before 1.30.13 and from 2.0.0 before 2.4.0 contains an out-of-bounds read (CWE-125) in SCRAM authentication response parsing. A malformed server-final message makes the driver read one byte beyond a fixed-size buffer. A server or network intermediary able to send this message before server-signature verification can crash the application using the driver, and the extra byte is not returned through the protocol.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Fix Fixed C Driver (MongoDB): 1.30.13, 2.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBC Driver1.1.0 to before 1.30.13; 2.0.0 to before 2.4.01.30.13, 2.4.0Patch availableCNA
  • C Driver VendorMongoDB Affected 1.1.0 to before 1.30.13; 2.0.0 to before 2.4.0 Fixed in 1.30.13, 2.4.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:*:*:*——MongoDB
  • cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:*:*:* Versions — — ·MongoDB

Remediation

Upgrade the MongoDB C Driver to version 1.30.13 or 2.4.0. The sources do not list a vendor advisory for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA C Driver (MongoDB) Fixed in 1.30.13, 2.4.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-106428
  2. 2026-10-10 Affected versions changed · Red Hat
  3. 2026-10-10 CVSS score added · Red Hat

References

Other 1

  • TI-2019-08023 Code injection in mongo-express KEVCVSS 3.1CRITICAL 9.9
  • TI-2025-13542 Zlib compressed protocol header length confusion may allow memory read KEVCVSS 4.0HIGH 8.7
  • TI-2026-79432 BSON output corruption via out-of-range binary subtype in MongoDB C# Driver CVSS 4.0MEDIUM 6.9
  • TI-2026-79424 NoSQL command injection via mismatched BSON length in MongoDB C# Driver CVSS 4.0MEDIUM 6.9
  • TI-2026-79422 Unbounded memory growth in MongoDB C# Driver BSON deserialization CVSS 4.0HIGH 8.2
  • TI-2026-79427 Authentication bypass via issuer-and-serial-only certificate equality CVSS 4.0HIGH 7.6
See all 376 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences