CVE-2026-84964
Awaiting Analysis Awaiting Analysis - Queue

Double Free in MongoDB C Driver TLS Certificate Handling

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: MongoDB, Inc.

Description
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84964
EUVD
EUVD-2026-70514

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mongodb mongodb_c_driver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a double free issue in the MongoDB C Driver's TLS certificate revocation checking path. It occurs when specially crafted certificate data causes the same heap object to be freed twice during a handshake with a trusted TLS endpoint. This can lead to unexpected termination of the client application.

Detection Guidance

This vulnerability involves a double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver. Detection requires checking the version of the MongoDB C Driver in use. If you are using a vulnerable version, inspect network traffic for unexpected TLS handshake terminations from trusted endpoints.

Impact Analysis

An unauthenticated attacker acting as a trusted TLS endpoint could exploit this to crash the client application using the MongoDB C Driver. This results in denial of service for the application.

Mitigation Strategies

Immediately update the MongoDB C Driver to the latest patched version. If updating is not possible, disable TLS certificate revocation checking as a temporary workaround. Monitor network traffic for unexpected terminations from trusted endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84964. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart