CVE-2026-84971: falha de alta gravidade em MongoDB libmongocrypt
Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
MongoDB · libmongocryptCVEs relacionadas — MongoDB libmongocrypt
No mesmo produto, das mais perigosas para as menos.
CVE-2026-106429HIGHApplication denial of service via malformed KMS endpoint in MongoDB libmongocryptEPSS 0.3%CVE-2026-114655MEDIUMKMS request injection via unsanitized key vault and provider values in libmongocryptEPSS 0.3%CVE-2026-106433HIGHHeap corruption via duplicate masterKey fields in MongoDB libmongocryptEPSS 0.3%CVE-2026-84962MEDIUMAuthenticated KMS request forgery via CRLF injection in GCP key identifier stringsEPSS 0.2%CVE-2026-106434MEDIUMUnrecognized payload acceptance in explicit decryption in MongoDB libmongocryptEPSS 0.1%CVE-2026-81523LOWCross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocryptEPSS 0.1%