Skip to content
CVE PROGRAM SOURCE RECORD2.0 Low

CVE-2026-4359

Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer

Description

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc MongoDB C Driver

Default version status: unaffected

  • 0 to < 2.2.3affected

References