CVE-2026-106429

An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.

Score
CVSS 4.0 7.1 High
Status
Awaiting Analysis - cna@mongodb.com
Published
2026-10-08
Last modified
2026-10-08
Weaknesses
CWE-191

Affected products

References

 
 
© AVABIS GmbH privacypolicy about