{"id":"CVE-2026-114645","title":"mongo-c-driver: mongo-c-driver: Denial of Service via integer wraparound in Windows authentication (CVE-2026-114645)","summary":"A flaw was found in mongo-c-driver. An integer wraparound in the Windows-native Kerberos authentication code can occur when an excessively long credential value is supplied in the client connection configuration. An attacker capable of mod…","severity":"medium","cvss":5.2,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","cvssSource":"vendor","cwe":["CWE-190"],"vendor":"Red Hat","product":"C Driver","affected":["c_driver >= 1.6.0 < 1.30.14","c_driver >= 2.0.0 < 2.5.7"],"published":"2026-10-22","updated":"2026-10-23","sourceUpdated":"2026-10-23T11:00:05+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114645.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114645.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-114645"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114645"},{"url":"https://jira.mongodb.org/browse/CDRIVER-6421"},{"url":"https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.14"},{"url":"https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.7"},{"url":"https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-g9mw-2cwh-6hh9"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-22T22:00:50.430Z","epss":0.00166,"epssPercentile":0.05823,"slug":"CVE-2026-114645","body":"## Overview\n\nA flaw was found in mongo-c-driver. An integer wraparound in the Windows-native Kerberos authentication code can occur when an excessively long credential value is supplied in the client connection configuration. An attacker capable of modifying this client configuration can cause the driver to allocate an undersized memory buffer and write outside its bounds. This flaw may result in memory corruption and a Denial of Service (DoS) of the client application.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114645.json)\n\n**mongo-c-driver: mongo-c-driver: Denial of Service via integer wraparound in Windows authentication**. Released 2026-10-22, updated 2026-10-23.\n\nNot affected:\n\n- All currently supported Red Hat products\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":28.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}