PT-2026-108138

Name of the Vulnerable Software and Affected Versions libmongocrypt affected versions not specified Description Improper state management occurs when cleaning up a key document that contains duplicate masterKey fields, causing provider-specific data to be treated as an incompatible type. An...

PT-2026-108135

Name of the Vulnerable Software and Affected Versions MongoDB libmongocrypt affected versions not specified Description An integer underflow exists in the KMS endpoint-parsing logic. This occurs when an authenticated user modifies a key document in the key vault collection, or when an application...

CVE-2026-106434: Improper Validation of Integrity Check Value

The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application...

CVE-2026-106433: Access of Resource Using Incompatible Type

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document,...

Linux Distros Unpatched Vulnerability : CVE-2026-81523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted witho...

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81523

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81523: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

PT-2026-82737

Name of the Vulnerable Software and Affected Versions MongoDB libmongocrypt affected versions not specified Description A missing input-validation issue exists in the automatic-encryption context setup of MongoDB libmongocrypt. This flaw allows a caller-supplied database identifier to be accepted...