EUVD-2026-12640Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered attack requiring MitM positioning (AC:H); no privileges on the target system itself; availability-only impact limited to application crash.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
AnalysisAI
Crash-inducing denial-of-service in the MongoDB C Driver (all versions before 2.2.3) allows a network-privileged adversary - either a compromised third-party cloud server the application trusts or a man-in-the-middle attacker on the network path - to crash the consuming application by delivering a malformed HTTP response. The vulnerability carries a CVSS 4.0 score of 2.0 due to high attack complexity, prerequisite network positioning, and impact limited strictly to low availability on the vulnerable system. No public exploit code exists and EPSS probability sits at 0.03% (8th percentile), indicating negligible observed exploitation activity at time of analysis.
Technical ContextAI
The MongoDB C Driver (libmongoc), identified by CPE cpe:2.3:a:mongodb_inc:mongodb_c_driver:*:*:*:*:*:*:*:*, is a native C-language client library used by applications to communicate with MongoDB database instances, frequently in cloud-hosted architectures. The root cause is CWE-158 - Improper Neutralization of Null Byte or NUL Character - meaning the driver's HTTP response parsing logic fails to safely sanitize or reject null bytes or similarly malformed control characters embedded in server responses. Because the driver is written in C with no managed memory safety, such a parsing failure translates directly into a process crash or abort rather than a recoverable error condition. The flaw is triggered during the response-reading phase of the driver's communication with a MongoDB endpoint, not during connection setup or query construction.
RemediationAI
Upgrade to MongoDB C Driver version 2.2.3 or later, which contains the vendor-released patch per EUVD-2026-12640 and MongoDB JIRA CDRIVER-6251 (https://jira.mongodb.org/browse/CDRIVER-6251). For Debian-based systems, apply the distribution-provided package update for the tracked release; consult the Debian security tracker for per-release package versions. If an immediate upgrade is not operationally feasible, enforce TLS mutual authentication on all MongoDB connections to reduce the ability of compromised intermediaries to inject malformed responses - note this hardens the transport layer but does not eliminate the underlying parser flaw. Additionally, restricting the application's outbound MongoDB connectivity to fully trusted, internal endpoints via network access controls (firewall rules, VPC security groups) limits MitM exposure at the cost of constraining architectural flexibility. No specific feature can be disabled to remove the vulnerable code path, as the flaw lies in the core HTTP response parser.
More in Mongodb C Driver
View allSame technique Denial Of Service
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1.17.6-1 | - |
| bullseye (security) | vulnerable | 1.17.6-1+deb11u2 | - |
| bookworm | vulnerable | 1.23.1-1+deb12u2 | - |
| trixie | vulnerable | 1.30.4-1+deb13u1 | - |
| forky, sid | fixed | 2.2.3-1 | - |
| (unstable) | fixed | 2.2.3-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today