# CVE-2026-120678: MongoDB C Driver memory leak in compressed responses

Source: https://junglewise.ai/threats/cve-2026-120678-a-memory-management-flaw-in-the-mongodb-c-driver-s-handling-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-120678 · Severity: high · CVSS 7.5 · Published 2026-11-03

The MongoDB C Driver, a library that applications use to connect to MongoDB databases, contains a memory leak when handling compressed database responses. An attacker who can intercept or control the database connection can send specially crafted compressed responses that cause the client application to consume memory indefinitely, eventually crashing the application and causing a denial of service.

Technologies: [MongoDB C Driver](https://junglewise.ai/threats/technologies/c-driver). Vendors: [MongoDB](https://junglewise.ai/threats/vendors/mongodb).

## Quick answers

**Is CVE-2026-120678 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120678 being exploited in the wild.

**How severe is CVE-2026-120678?** High severity, with a CVSS score of 7.5, published 3 November 2026.

**Which products and versions are affected?** MongoDB C Driver.

**Is there a fix for CVE-2026-120678?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120678 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120678?** Check whether you run MongoDB C Driver. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory management flaw in the MongoDB C Driver's handling of compressed responses causes the client library to retain memory that should be freed, leading to unbounded memory growth. An unauthenticated attacker controlling the database endpoint can trigger this vulnerability without requiring credentials, transport security, or user interaction, resulting in denial of service through resource exhaustion.

## Affected products

- MongoDB C Driver

## Timeline

- 2026-11-03: disclosed

## References

- [https://jira.mongodb.org/browse/CDRIVER-6521](https://jira.mongodb.org/browse/CDRIVER-6521)

## Related threats

- [MongoDB C# Driver BSON type allow-list bypass](https://junglewise.ai/threats/cve-2026-126982-a-type-allow-list-bypass-in-the-bson-serialization-library-of)
- [MongoDB C Driver namespace field validation bypass](https://junglewise.ai/threats/cve-2026-120956-the-mongodb-c-driver-does-not-validate-the-type-or-format-of-a)
- [MongoDB C Driver GridFS file download denial of service](https://junglewise.ai/threats/cve-2026-120955-the-gridfs-file-download-api-in-the-mongodb-c-driver-does-not)
- [MongoDB C Driver memory-initialization flaw in GridFS](https://junglewise.ai/threats/cve-2026-120684-a-memory-initialization-flaw-in-the-legacy-gridfs-file-handling)
- [MongoDB C# Driver BSON numeric type conversion in binary subtype](https://junglewise.ai/threats/cve-2026-114654-a-numeric-type-conversion-flaw-in-the-bson-handling-library-of)