{"id":"CVE-2026-106428","published":"2026-10-08T19:16:58.587","lastModified":"2026-10-08T20:49:23.240","description":"An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.","cvssScore":3.7,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://jira.mongodb.org/browse/CDRIVER-6370","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}