Bug 2559503

Summary: CVE-2026-114645 mongo-c-driver: mongo-c-driver: Denial of Service via integer wraparound in Windows authentication [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Ganesh <gnaik>
Component: mongo-c-driverAssignee: Remi Collet <fedora>
Status: ON_QA --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: epel10CC: fedora
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["21538ee2-76a4-4625-a2a0-04e42c83a626"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2559380    

Description Ganesh 2026-10-23 08:33:07 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.

Comment 1 Fedora Update System 2026-10-27 07:59:16 UTC
FEDORA-EPEL-2026-effa947464 (mongo-c-driver-2.5.7-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-effa947464

Comment 2 Fedora Update System 2026-10-27 07:59:26 UTC
FEDORA-EPEL-2026-f7bf3fe89b (mongo-c-driver-2.5.7-1.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f7bf3fe89b

Comment 3 Fedora Update System 2026-10-27 08:27:45 UTC
FEDORA-EPEL-2026-fdeda5effc (mongo-c-driver-1.30.14-1.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-fdeda5effc

Comment 4 Fedora Update System 2026-10-27 08:27:45 UTC
FEDORA-EPEL-2026-d9e57185b1 (mongo-c-driver-1.30.14-1.el8) has been submitted as an update to Fedora EPEL 8.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d9e57185b1

Comment 5 Fedora Update System 2026-10-27 08:27:45 UTC
FEDORA-EPEL-2026-6638625c0c (mongo-c-driver-1.30.14-1.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6638625c0c

Comment 6 Fedora Update System 2026-10-28 02:20:58 UTC
FEDORA-EPEL-2026-d9e57185b1 has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d9e57185b1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-10-28 02:26:56 UTC
FEDORA-EPEL-2026-fdeda5effc has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-fdeda5effc

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-10-28 02:59:00 UTC
FEDORA-EPEL-2026-f7bf3fe89b has been pushed to the Fedora EPEL 10.4 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f7bf3fe89b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-10-28 03:30:04 UTC
FEDORA-EPEL-2026-effa947464 has been pushed to the Fedora EPEL 10.3 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-effa947464

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2026-10-28 03:40:00 UTC
FEDORA-EPEL-2026-6638625c0c has been pushed to the Fedora EPEL 10.2 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6638625c0c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.