Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-106428

Out-of-bounds read in SCRAM response parsing in MongoDB C Driver

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB C Driver

Default version status: unaffected

  • 1.1.0 to < 1.30.13affected
  • 2.0.0 to < 2.4.0affected

References