High severity7.8NVD Advisory· Published May 6, 2026· Updated Jun 18, 2026
CVE-2026-6691
CVE-2026-6691
Description
The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*+ 1 more
- cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*range: >=2.1.0,<2.1.2
- (no CPE)
Patches
Vulnerability mechanics
References
1- jira.mongodb.org/browse/CDRIVER-6134nvdPatchVendor AdvisoryIssue Tracking
News mentions
0No linked articles in our index yet.