Decryption Path Vulnerability in Client-Side Encryption Library by MongoDB
CVE-2026-84971

7.1HIGH

Key Information:

Vendor

Mongodb
Status
LIBMongocrypt
Vendor
CVE Published:
3 September 2026

What is CVE-2026-84971?

A vulnerability exists in the client-side encryption library provided by MongoDB, where improper handling of an unexpected size in the decryption process may lead to a failed internal check. This mismanagement can result in the termination of applications that utilize this library, particularly if an attacker is able to inject suitably formatted encrypted data for decryption. Consequently, applications may become unresponsive, impacting their overall functionality and security.

Affected Version(s)

libmongocrypt 1.7.0 < 1.20.4

References

https://jira.mongodb.org/browse/MONGOCRYPT-971

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.