CVE-2026-93394mediumCWE-303

CVE-2026-93394: falha de média gravidade em MongoDB Inc. C Driver

libmongoc SCRAM client nonce-validation bypass

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar C Driver+ Monitorar mongo-c-driver

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.3%
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
MongoDB Inc. · C Driver
CVEs relacionadas — MongoDB Inc. C Driver

No mesmo produto, das mais perigosas para as menos.

CVE-2026-93393CRITICALHeap overflow via oversized decrypted TLS record sequence in Windows Secure Channel streamEPSS 0.5%CVE-2026-93395MEDIUMInteger Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()EPSS 0.4%CVE-2026-6231MEDIUMbson_validate may skip validation when processing certain inputsEPSS 0.2%