A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b4c749cdd2 advisory.

    ## libbson 1.30.11

    Fixes

    -    Fix length check in bson_new_from_buffer.

    ----

    ## libmongoc 1.30.11

    Fixes

    -    Fix allocation in Windows Secure Channel.
    -    Fix error handling in SCRAM authentication.


    ----

    ## libmongoc 1.30.10

    Fixes

    -     Use exact match for file ID in GridFS methods **CVE-2026-88036**
    -    Validate SASL username **CVE-2026-88035**


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0fcc2d09c6 advisory.

    ## libmongoc 2.5.4

    Fixes

    -    Fix allocation in Windows Secure Channel.


    ----

    ## libmongoc 2.5.3

    Fixes

    -    Use exact match for file ID in GridFS methods **CVE-2026-88036**
    -    Validate SASL username **CVE-2026-88035**


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4286ff2dfd advisory.

    ## libbson 1.30.11

    Fixes

    -    Fix length check in bson_new_from_buffer.

    ----

    ## libmongoc 1.30.11

    Fixes

    -    Fix allocation in Windows Secure Channel.
    -    Fix error handling in SCRAM authentication.


    ----

    ## libmongoc 1.30.10

    Fixes

    -     Use exact match for file ID in GridFS methods **CVE-2026-88036**
    -    Validate SASL username **CVE-2026-88035**


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an     unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set     the driver's connection settings may cause the application that embeds the driver to terminate     unexpectedly. Reaching this code requires a build in which the optional external SASL authentication     backend is present and a connection configured to use it. (CVE-2026-88035)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350836	Fedora 43 : mongo-c-driver (2026-b4c749cdd2)	Nessus	Fedora Local Security Checks	Local	medium
350804	Fedora 45 : mongo-c-driver (2026-0fcc2d09c6)	Nessus	Fedora Local Security Checks	Local	medium
350797	Fedora 44 : mongo-c-driver (2026-4286ff2dfd)	Nessus	Fedora Local Security Checks	Local	medium
344710	Linux Distros Unpatched Vulnerability : CVE-2026-88035	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-88035

medium

Tenable Plugins

medium

medium

medium

medium