Libmongocrypt (Mongodb) - vulnerabilities (CVEs)

7 CVEs, 4 in the last 30 days, 119 known versions, newest CVE from 2026-10-22. Vendor: Mongodb.

CVEs of Libmongocrypt

• CVE-2026-114655 - CVSS 6 (medium), 2026-10-22: libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider…
• CVE-2026-106434 - CVSS 5.3 (medium), 2026-10-08: The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An…
• CVE-2026-106433 - CVSS 8.8 (high), 2026-10-08: Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document…
• CVE-2026-106429 - CVSS 7.1 (high), 2026-10-08: An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This…
• CVE-2026-84962 - CVSS 5.7 (medium), 2026-09-03: An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the…
• CVE-2026-84971 - CVSS 7.1 (high), 2026-09-03: Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the…
• CVE-2026-81523 - CVSS 4.4 (medium), 2026-08-27: A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted…