Bug 2567329

Summary: CVE-2026-120678 mongo-c-driver: mongo-c-driver: Denial of Service via memory leak in compressed response handling [fedora-all]
Product: [Fedora] Fedora Reporter: Oleg Sushchenko <osushche>
Component: mongo-c-driverAssignee: Remi Collet <fedora>
Status: MODIFIED --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: fedora
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["dec409d3-19d9-4b87-adb8-9222f7c289a1"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2566133    

Description Oleg Sushchenko 2026-11-05 14:43:31 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.
Comment 1 Fedora Update System 2026-11-06 06:03:22 UTC 
FEDORA-2026-be6a432dc3 (mongo-c-driver-1.30.15-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-be6a432dc3
Comment 2 Fedora Update System 2026-11-06 06:03:28 UTC 
FEDORA-2026-43d95b04a7 (mongo-c-driver-1.30.15-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-43d95b04a7
Comment 3 Fedora Update System 2026-11-06 06:03:33 UTC 
FEDORA-2026-4701fdc782 (mongo-c-driver-2.5.8-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-4701fdc782