CVE-2026-88035: 
MongoDB Analisi e mitigazione delle vulnerabilità

CVE-2026-88035 is an integer overflow vulnerability in the MongoDB C Driver that causes a buffer overwrite in the client-side SASL authentication path. An unusually large username value passes a size check that wraps around, allowing data to be copied past the end of a small buffer. The vulnerability affects MongoDB C Driver versions 2.2.0 through 2.5.3 (exclusive) and is only reachable when the optional external SASL authentication backend is compiled in and configured for use. It was published on September 10, 2026, with a CVSS v3.1 score of 4.7 (Medium) and a CVSS v4.0 score of 5.7 (Medium) (GitHub Advisory).

The root cause is an integer overflow or wraparound (CWE-190) in the size validation logic within the client-side authentication code path of the MongoDB C Driver. When a username of unusual length is supplied, the size check wraps around to a small or zero value, causing the driver to accept the oversized input and copy it past the end of a fixed-size stack or heap buffer — an out-of-bounds write (CWE-787 estimated). Exploitation requires: (1) a build of the driver that includes the optional external SASL authentication backend (e.g., Cyrus SASL), (2) a connection configured to use that backend, and (3) local access with the ability to influence the driver's connection settings. The vulnerability is tracked upstream as CDRIVER-6416 (GitHub Advisory).

Successful exploitation causes the application embedding the MongoDB C Driver to terminate unexpectedly, resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable code execution or data exfiltration based on current analysis. The scope is confined to the vulnerable system itself, with no downstream or lateral movement potential identified (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-automatable and requires local access with the ability to set driver connection settings, significantly limiting the attacker pool. NVD SSVC assessment classifies exploitation as "none" (GitHub Advisory).

MongoDB has released a patch in C Driver version 2.5.3, which resolves the integer overflow in the SASL authentication size check. Users running versions 2.2.0 through 2.5.2 should upgrade to 2.5.3 or later. As interim mitigations: disable or avoid using the optional external SASL authentication backend if it is not required; restrict modification of driver connection settings to trusted administrators only; and validate any user-supplied input used to configure authentication parameters (GitHub Advisory).