What’s Vulnerable › Products

MongoDB libmongocrypt vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your MongoDB libmongocrypt version is affected

Latest MongoDB libmongocrypt vulnerabilities

• CVE-2026-114655 — KMS request injection via unsanitized key vault and provider values in libmongocrypt (CVSS 5.9)
• CVE-2026-106434 — Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt (CVSS 4.3)
• CVE-2026-106433 — Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt (CVSS 8.8)
• CVE-2026-106429 — Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt (CVSS 6.5)
• CVE-2026-84962 — Authenticated KMS request forgery via CRLF injection in GCP key identifier strings (CVSS 4.2)
• CVE-2026-84971 — Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path (CVSS 6.5)
• CVE-2026-81523 — Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt (CVSS 4.4)