Threats affecting pkg:github/mongodb/mongo-c-driver

CVE-2026-114645 is a medium severity integer overflow vulnerability in the MongoDB C Driver affecting Windows client builds using the native Kerberos/SSPI authentication backend. It arises from a 32-bit integer wraparound that causes an undersized heap buffer allocation when an excessively long credential value is supplied in the client's connection configuration. This can lead to out-of-bounds writes, potentially corrupting client process memory and causing denial of service. The issue affects versions >=1.6.0 <1.30.14 and >=2.0.0 <2.5.7 and has been fixed in versions 1.30.14 and 2.5.7.

CVE-2026-96746 is a high-severity vulnerability in the MongoDB C Driver involving an out-of-bounds write in the connection-monitoring logic. An unauthenticated attacker who can control DNS resolution and responses for hosts in a client's connection string may exploit this to write beyond the end of a heap buffer, potentially causing the application to crash unexpectedly.

A mongoc_bulk_operation_t may read invalid memory if large options are passed.