MongoDB libmongocrypt vulnerabilities

Newest CVEs

• CVE-2026-114655

  KMS request injection via unsanitized key vault and provider values in libmongocrypt

  MongoDB · libmongocrypt

  Medium6.0
• CVE-2026-106434

  Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt

  MongoDB · libmongocrypt

  Medium5.3
• CVE-2026-106433

  Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

  MongoDB · libmongocrypt

  High8.7
• CVE-2026-106429

  Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt

  MongoDB · libmongocrypt

  High7.1
• CVE-2026-84962

  Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

  MongoDB · libmongocrypt

  Medium5.7
• CVE-2026-84971

  Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

  MongoDB · libmongocrypt

  High7.1
• CVE-2026-81523

  Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt

  MongoDB · libmongocrypt

  Low2.0