CVE-2026-4359
Mongodb C Driver ≤ 1.30.8
Raw vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-4359 is a low-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Mongodb C Driver. Its CVSS base score is 2.0 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12640
Vulnerability Data
A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Malformed HTTP response from MITM/compromised server directly triggers client application crash via input handling flaw (CWE-158).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of untrusted HTTP responses before processing, preventing the malformed input crash described in the CVE.
Provides integrity protection on data in transit, mitigating MITM tampering that could deliver the malformed HTTP response.
Boundary protection mechanisms can filter or reject anomalous/malformed traffic from external or compromised endpoints before it reaches the MongoDB C driver.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect null-byte flaws but does not itself implement the neutralization.
Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.
Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.
Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.