{"id":"CVE-2026-88035","title":"A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer","summary":"A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection setting…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-190"],"vendor":"mongodb","product":"c_driver","affected":["c_driver >= 1.10.0, < 1.30.10","c_driver >= 2.2.0, < 2.5.3"],"patched":["c_driver 2.5.3"],"published":"2026-09-10","updated":"2026-09-16","sourceUpdated":"2026-09-16T18:08:46.303","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88035","references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6416","label":"cna@mongodb.com"}],"tags":["nvd","cve.org"],"epss":0.00103,"epssPercentile":0.01089,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T18:29:41.143877Z"},"ingestedAt":"2026-09-13T19:09:30.561Z","slug":"CVE-2026-88035","body":"## Overview\n\nA size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.\n\n## Affected\n\n- `c_driver >= 1.10.0, < 1.30.10`\n- `c_driver >= 2.2.0, < 2.5.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `c_driver 2.5.3`","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}