A double free in the OpenSSL-based TLS certificate revocation path of the MongoDB C Driver can be induced by a trusted TLS endpoint that sends specially crafted certificate data. When the driver processes the certificate chain, it releases the same heap object twice, leading the client application to terminate unexpectedly. This flaw does not directly compromise data confidentiality or integrity, but it does cause a denial‑of‑service condition for applications using the driver.

The vulnerability affects the MongoDB C Driver, used in applications that connect to MongoDB over TLS. No specific driver version is listed, so any version that includes this OpenSSL TLS logic is potentially impacted.

With a CVSS score of 8.2 the risk is considered high. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, indicating limited known exploitation. An attacker who can impersonate a trusted TLS endpoint can trigger the double free during the TLS handshake, causing the client to crash. The attack requires network access to the client and the ability to act as a trusted server.