CVE-2026-120678

The record

A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.

Affected packages

Related vulnerabilities

• CVE-2026-121512 Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows… CWE-401
• CVE-2026-120440 QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in… CWE-401
• CVE-2026-119286 GraphQL-core is a Python port of the GraphQL.js reference implementation. CWE-401
• CVE-2026-116157 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails… CWE-401
• CVE-2026-116158 ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare… CWE-401
• CVE-2026-116159 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the… CWE-401
• CVE-2026-116156 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a… CWE-401
• CVE-2026-116151 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG… CWE-401