CVE-2026-120955

EUVD-2026-116137
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mongodbCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
mongodbc_driver
1.25.0 ≤
𝑥
≤ 1.30.14
CNA
mongodbc_driver
2.0.0 ≤
𝑥
≤ 2.5.7
CNA
Common Weakness Enumeration
References
https://jira.mongodb.org/browse/CDRIVER-6494