MongoDB C Driver CVE-2026-120678

Exploitation requires that the application's MongoDB C Driver connect to a database endpoint the attacker controls or can influence (a rogue/compromised MongoDB server or a man-in-the-middle position), and that the connection use MongoDB wire-protocol compression so the driver processes the crafted compressed responses that are never freed. Within those conditions it is unauthenticated with no user interaction (PR:N/UI:N) and works regardless of transport security settings. The key limiting factor is server-side trust: an attacker cannot trigger it merely by reaching the client over the network - they must be the endpoint the client talks to (or intercept it), which meaningfully narrows realistic exploitation to untrusted-endpoint or MITM scenarios.

The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H...) scored 8.7 (High), with impact confined entirely to availability (VA:H; VC:N/VI:N) - consistent with CWE-401 missing release of memory leading to resource exhaustion, not data exposure. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact breakdown are supplied; the only priority signal is the vuln.today Decision label 'this_week', which indicates a prioritized-but-not-emergency timeline rather than active exploitation. The single reference is a MongoDB JIRA tracker (CDRIVER-6521), i.e. a vendor issue record, not verified working exploit code. The most important nuance the raw 8.7 obscures is the exploitation precondition in the description: the attacker must control the database endpoint the client connects to. So while the vector is correctly AV:N/PR:N/UI:N (unauthenticated, no user interaction), real-world risk is gated by whether an attacker can make a client connect to a rogue/compromised MongoDB server or man-in-the-middle the connection, rather than by attacking an exposed service directly. Treat this as a genuine availability/DoS concern for applications that may connect to untrusted or attacker-influenceable endpoints, but not a mass-exploitable internet-facing flaw; absence of EPSS/KEV data means widespread exploitation cannot be inferred.

An attacker who operates or has compromised the MongoDB endpoint a client application connects to (or who can MITM the connection) returns specially crafted compressed server responses. Each response causes the MongoDB C Driver to retain memory it never frees, so sustained traffic drives unbounded memory growth until the client application exhausts memory and becomes unavailable. No credentials, TLS settings, or user interaction are required; no verified public exploit code is identified at time of analysis (the sole reference is a vendor JIRA ticket).