Executive brief
The MongoDB C Driver contains a flaw in its client-side authentication code that can cause an integer overflow when processing unusually large usernames. An attacker with the ability to control the driver's connection settings can exploit this to crash applications that embed the driver, resulting in denial of service.
Technical details
The vulnerability is an integer overflow in the size check of the client-side authentication path when using the optional external SASL authentication backend. When a username exceeds a certain length threshold, the size check wraps around due to integer overflow, causing an undersized buffer to accept an oversized username value. This leads to a buffer overflow that writes past the allocated buffer boundary. The vulnerability requires the external SASL authentication backend to be compiled in and a connection explicitly configured to use it. An attacker who can control the driver's connection settings (username, authentication mechanism) can trigger the flaw and cause the application to terminate unexpectedly.
Affected products
- MongoDB C Driver before 1.30.10 and 2.5.3
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched