CVE-2026-4359 - Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer

Back Back to CVE browser

LOW

Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer

Published Mar 17, 2026

2.0

LOW

CVSS 4.0

EPSS 0.24%

Description

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

Affected products

Vendor MongoDB Inc Product MongoDB C Driver Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.2.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

MongoDB Inc

MongoDB C Driver

unaffected

Version	Status	Constraints
0	affected	<2.2.3

Remediation

Red Hat statement

This LOW impact vulnerability in the MongoDB C driver allows denial of service via malformed HTTP responses. Exploitation requires high complexity—either a compromised cloud server or active MITM position. Impact is limited to availability. Applications are only vulnerable when connecting to untrusted MongoDB instances or over untrusted networks.

Weaknesses (2)

CWE-158

CWE-170

References (5)

https://access.redhat.com/security/cve/CVE-2026-4359
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2448447
Issue Tracking
https://jira.mongodb.org/browse/CDRIVER-6251
PatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4359
https://www.cve.org/CVERecord?id=CVE-2026-4359

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-4359		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2448447		Issue Tracking
https://jira.mongodb.org/browse/CDRIVER-6251		PatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4359
https://www.cve.org/CVERecord?id=CVE-2026-4359