CVE-2026-114645 MongoDB CVE debrief

Who should care

Defenders responsible for MongoDB C Driver deployments, particularly those using Windows-native authentication backend, should assess exposure and prioritize verification and updates.

Why it matters

Defenders should prioritize verifying and updating MongoDB C Driver versions to prevent potential heap overflow attacks, particularly in Windows-native authentication backend deployments.

• Potential denial of service of the client application
• Possible corruption of client process memory
• Verification of MongoDB C Driver version and client-side configuration required
• Remediation priority for versions 1.6.0 to 1.30.13 and 2.0.0 to 2.5.6

Technical summary

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. This may result in corruption of client process memory and denial of service of the client application. The issue affects client builds compiled with the Windows-native authentication backend, requiring defenders to verify and update vulnerable versions. Limited information is available on affected versions.

Defensive priority

Defenders should prioritize verifying and updating MongoDB C Driver versions to prevent potential heap overflow attacks.

Recommended defensive actions

• Verify MongoDB C Driver version and update to 1.30.14 or later for versions 1.6.0 to 1.30.13, or to 2.5.7 or later for versions 2.0.0 to 2.5.6
• Review client-side configuration for excessively long credential values
• Monitor client application for denial of service and memory corruption
• Perform exposure review for Windows-native authentication backend deployments
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Review compensating controls for exposed systems

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on affected versions and remediation. Evidence is grounded in CVE Program and NVD records. Defenders should verify MongoDB C Driver versions and client-side configurations. Limited source information suggests versions 1.6.0 to 1.30.13 and 2.0.0 to 2.5.6 may be affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.