CVE-2026-106428
Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Read in MongoDB C Driver SCRAM Authentication

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: MongoDB, Inc.

Description
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-09
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-106428
EUVD
EUVD-2026-95144

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
MongoDB C Driver 1.1.0
MongoDB C Driver 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver. It occurs when processing a malformed server-final message, causing the driver to read one byte beyond a fixed-size buffer. This can lead to application termination if exploited by a server or network intermediary before server-signature verification.

Detection Guidance

This vulnerability involves an out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver. Detection requires checking if your system uses a vulnerable version of the MongoDB C Driver. Inspect installed packages for the driver version and monitor for crashes during SCRAM authentication. No specific commands are provided in the context.

Impact Analysis

The impact includes application crashes due to out-of-bounds reads. While the extra byte is not exposed through the protocol, the crash can disrupt services relying on the MongoDB C Driver for authentication, potentially causing denial of service.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing sensitive data through out-of-bounds read in SCRAM authentication. Unauthorized access to memory could lead to data breaches, violating confidentiality requirements under these regulations.

Mitigation Strategies

Immediately update the MongoDB C Driver to the latest patched version. If updating is not possible, disable SCRAM authentication or restrict network access to trusted sources to prevent malicious server-final messages from reaching the driver.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart