---
id: CVE-2026-120678
title: >-
  MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED
  reply fails to parse (denial of service)
summary: >-
  A memory management flaw in the MongoDB C Driver's handling of compressed
  responses may cause the client library to hold on to memory that is never
  released. An unauthenticated party that controls the database endpoint a
  client applicati…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-401
vendor: MongoDB
product: C Driver
affected:
  - c_driver >= 1.25.0 <= 1.30.14
  - c_driver >= 2.0.0 <= 2.5.7
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T20:11:30.272347Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:11:43.371Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120678'
references:
  - url: 'https://jira.mongodb.org/browse/CDRIVER-6521'
tags:
  - cve.org
epss: 0.00389
epssPercentile: 0.33171
ingestedAt: '2026-11-05T20:33:06.432Z'
---

## Overview

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

## Affected

- `c_driver >= 1.25.0 <= 1.30.14`
- `c_driver >= 2.0.0 <= 2.5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.