CVE-2026-106428 — Out-of-bounds read in SCRAM response parsing in MongoDB C Driver

CVE-2026-106428

Out-of-bounds read in SCRAM response parsing in MongoDB C Driver PUBLISHED

Description (CNA)

An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.

Affected (CNA)

Vendor / product	Versions
MongoDB / C Driver	affected 1.1.0 before 1.30.13; affected 2.0.0 before 2.4.0

CWE

CWE-125

References

https://jira.mongodb.org/browse/CDRIVER-6370

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.