CVE-2026-84964 is a medium severity (CVSS 5.9) double free in the MongoDB C Driver's OpenSSL certificate revocation check. A TLS endpoint the client already trusts can crash the connecting application. MongoDB's Jira ticket lists the fixes in versions 2.5.2 and 1.30.9.
What's affected
The record describes a double free in the OpenSSL based TLS certificate revocation checking path of the MongoDB C Driver. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint can make the connecting client application terminate.
The linked Jira ticket, CDRIVER-6409, is titled "OCSP check may double-free" and is closed as fixed. Its fix versions are 2.5.2 and 1.30.9. The record itself names no versions, so the ticket is my source.
Priority conflict: the record scores this 5.9 Medium, with availability as the only impact. The Jira ticket carries a priority of Critical (P2). Those are different scales, the vendor's internal work priority and a public CVSS score, but a reader who sees both should know why they differ. The CVSS vector requires high attack complexity and a trusted endpoint, which keeps the public score moderate.
How to check if you're exposed
Find the version of the C driver your application uses. If you build against a system package, ask pkg-config:
pkg-config --modversion libmongoc-1.0
If you use a language driver that wraps the C driver, such as the PHP extension or others that bundle libmongoc, check that project's notes for the bundled version, because you will not see the C driver as a separate package. Versions below 1.30.9 on the 1.x line, or below 2.5.2 on the 2.x line, are the ones the fix addresses.
Then check whether your clients use TLS with certificate revocation checking enabled, since the flaw is in that path. Your connection string and TLS options show it. If revocation checking is off, the path may not be reached, though upgrading is still sensible.
What to do now
- Upgrade the MongoDB C Driver to 2.5.2 or 1.30.9, and rebuild every application that links it.
- If you use a language driver that bundles the C driver, update that driver to a release that includes the fixed C driver.
- Review the TLS settings of your clients and confirm which ones perform revocation checks.
- Connect only to MongoDB endpoints you operate or trust, over verified TLS.
- Watch for client processes that restart or crash during connection setup, which is the symptom to expect.
Why it matters
A double free, tracked as CWE-415, happens when code releases the same piece of memory twice. The second release can corrupt the memory manager's bookkeeping, and at worst lets an attacker steer later allocations. Here the record only describes a crash of the client, rated as an availability issue.
The trust requirement matters. The attacker has to be a TLS endpoint that the client already trusts, which means a compromised server, or a trusted certificate authority issuing a hostile chain. That makes it a hard attack and explains the medium score. Still, a driver that crashes while connecting is a bad failure for a service. The record does not list this CVE as exploited in the wild.
Quick check
Why is the Jira priority Critical while the score is 5.9?
The Jira priority is the vendor's work priority, while the CVSS score reflects the need for a trusted endpoint and high attack complexity. The two are separate measures.
Does the server need to be hostile?
The record says an unauthenticated party acting as a trusted TLS endpoint, so the server side of the connection must be hostile or compromised.
Sources
Last reviewed: 18 October 2026.
