CVE-2026-4359

Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer PUBLISHED

Description (CNA)

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.

Affected (CNA)

Vendor / product	Versions
MongoDB Inc / MongoDB C Driver	affected 0 before 2.2.3

CWE

CWE-158

References

https://jira.mongodb.org/browse/CDRIVER-6251

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.