CVE-2026-106429
MediumCVSS 6.5Summary
An integer underflow in MongoDB libmongocrypt's KMS endpoint-parsing logic can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.
Risk Assessment
An attacker can cause an application crash (denial of service), potentially disrupting systems relying on libmongocrypt for data encryption. The lack of out-of-bounds memory access limits risk to crashes, but it could be used for deliberate service disruption.
Recommendation
Update MongoDB libmongocrypt to the latest patched version. Additionally, restrict access to the key vault collection and validate KMS endpoints before use.
Other vulnerabilities in MongoDB libmongocrypt
See all- CVE-2026-106434Medium
The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.
- CVE-2026-81523Medium
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.
Original NVD description (English source)
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS