CVE-2026-84964 — MEDIUM (5.9)

Vulnerability Description

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

CVSS Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Related Weaknesses (CWE)

CWE-415

References

https://jira.mongodb.org/browse/CDRIVER-6409

FAQ

What is CVE-2026-84964?

CVE-2026-84964 is a vulnerability with a CVSS score of 5.9 (MEDIUM). A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially for...

How severe is CVE-2026-84964?

CVE-2026-84964 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-84964?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.