Answer in brief
CVE-2026-114645 records a Medium severity (CVSS 5.7) vulnerability in Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping. The current sources do not mark it as known exploited. The current feed maps MongoDB/C Driver (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps MongoDB/C Driver (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| MongoDB/C Drivergeneric | >=1.6.0 <1.30.14 || >=2.0.0 <2.5.7 | 1.30.14, 2.5.7 |
Published upstream
Oct 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 22, 2026
A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party able to control that client-side configuration, in conjunction with the affected authentication mechanism, can cause the driver to write outside the bounds of the allocated buffer. This may result in corruption of client process memory and denial of service of the client application. The issue affects only client builds compiled with the Windows-native authentication backend.
Quoted source text, attributed separately from HOL analysis.