DEBIAN-CVE-2026-120678

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-120678

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120678.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-120678

Upstream

CVE-2026-120678

Published

2026-11-03T19:17:59Z

Modified

2026-11-04T17:30:14Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

References

https://security-tracker.debian.org/tracker/CVE-2026-120678

Affected packages

Debian:12 / mongo-c-driver

Package

Name: mongo-c-driver
Purl: pkg:deb/debian/mongo-c-driver?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.23.1-1

1.23.1-1+deb12u1

1.23.1-1+deb12u2

1.23.1-1+deb12u3

1.24.1-1

1.24.2-1

1.24.3-1

1.24.4-1

1.25.0-1

1.25.1-1

1.25.2-1

1.25.4-1

1.25.4-1.1~exp1

1.26.0-1

1.26.0-1.1~exp1

1.26.0-1.1

1.26.1-1

1.26.2-1

1.27.0-1

1.27.1-1

1.27.2-1

1.27.3-1

1.27.4-1

1.27.5-1

1.27.6-1

1.28.0-1

1.28.1-1

1.29.0-1

1.29.1-1

1.29.2-1

1.30.0-1

1.30.1-1

1.30.2-1

1.30.3-1

1.30.4-1

2.*

2.0.2-1

2.1.0-1

2.1.1-1

2.1.2-1

2.2.0-1

2.2.1-1

2.2.2-1

2.2.3-1

2.2.4-1

2.3.0-1

2.3.1-1

2.3.2-1

2.3.3-1

2.4.0-1

2.5.0-1

2.5.1-1

2.5.2-1

2.5.3-1

2.5.5-1

2.5.6-1

2.5.7-1

2.5.8-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120678.json"

Debian:13 / mongo-c-driver

Package

Name: mongo-c-driver
Purl: pkg:deb/debian/mongo-c-driver?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.30.4-1

1.30.4-1+deb13u1

1.30.4-1+deb13u2

1.30.4-1+deb13u3

2.*

2.0.2-1

2.1.0-1

2.1.1-1

2.1.2-1

2.2.0-1

2.2.1-1

2.2.2-1

2.2.3-1

2.2.4-1

2.3.0-1

2.3.1-1

2.3.2-1

2.3.3-1

2.4.0-1

2.5.0-1

2.5.1-1

2.5.2-1

2.5.3-1

2.5.5-1

2.5.6-1

2.5.7-1

2.5.8-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120678.json"

Debian:14 / mongo-c-driver

Package

Name: mongo-c-driver
Purl: pkg:deb/debian/mongo-c-driver?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.30.4-1

2.*

2.0.2-1

2.1.0-1

2.1.1-1

2.1.2-1

2.2.0-1

2.2.1-1

2.2.2-1

2.2.3-1

2.2.4-1

2.3.0-1

2.3.1-1

2.3.2-1

2.3.3-1

2.4.0-1

2.5.0-1

2.5.1-1

2.5.2-1

2.5.3-1

2.5.5-1

2.5.6-1

2.5.7-1

2.5.8-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-120678.json"