SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityUndergoing Analysis

CVE-2026-84964

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts.

HIGH 8.2EPSS 0.15%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.

CVSS 4.0
8.2 HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS
0.15% probability · 4th percentile
CISA KEV
Not listed
Weakness
CWE-415
Source
cna@mongodb.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.