---
id: CVE-2026-84964
title: >-
  A double free in the OpenSSL-based TLS certificate revocation checking path of
  the MongoDB C Driver can be reached by a TLS endpoint that the client already
  trusts
summary: >-
  A double free in the OpenSSL-based TLS certificate revocation checking path of
  the MongoDB C Driver can be reached by a TLS endpoint that the client already
  trusts. During the handshake, specially formed certificate data can cause the
  sa…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-415
vendor: mongodb
product: c_driver
affected:
  - 'c_driver >= 1.17.0, < 1.30.9'
  - 'c_driver >= 2.0.0, < 2.5.2'
patched:
  - c_driver 2.5.2
published: '2026-09-03'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T16:19:25.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84964'
references:
  - url: 'https://jira.mongodb.org/browse/CDRIVER-6409'
    label: cna@mongodb.com
tags:
  - nvd
epss: 0.00257
epssPercentile: 0.15407
ingestedAt: '2026-09-22T17:07:07.357Z'
---

## Overview

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

## Affected

- `c_driver >= 1.17.0, < 1.30.9`
- `c_driver >= 2.0.0, < 2.5.2`

## Remediation

Upgrade past the affected range:

- `c_driver 2.5.2`