The MongoDB C Driver contains a memory management flaw in the handling of compressed responses. When an OP_COMPRESSED reply from a MongoDB server cannot be parsed, the driver erroneously retains the decompressed reply buffer and never releases it. An unauthenticated user that controls the database endpoint can send malformed or repeated compressed replies, causing the client library to consume increasingly large amounts of memory until the application exhausts available resources and becomes unavailable. No credentials or transport security settings are required for an attacker to exploit the vulnerability, which can be triggered purely through normal client-server communication.

MongoDB C Driver; affected across all supported versions. Specific version ranges are not disclosed in the available data.

The CVSS score is 8.7, indicating high severity. EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. The attack vector requires only that an application connect to a compromised or malicious MongoDB endpoint, with no authentication or user interaction needed. While the precise probability is not quantified, the lack of authentication barriers means the exploitation likelihood is non-negligible, and the resource exhaustion can lead to application unavailability.