CVE-2026-88032 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

CVE-2026-88032

A use-after-free vulnerability in the reactive client-side encryption component of the MongoDB Java Driver allows an attacker who can cause an affected encrypted operation to be cancelled to free native resources while they are still in use, leading to hosting application process termination (den...

Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

CVE-2026-88032: Use After Free

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the...

PT-2026-89546

Name of the Vulnerable Software and Affected Versions MongoDB Java Driver affected versions not specified Description A use-after-free issue exists in the reactive client-side encryption component. This occurs when an encrypted operation is cancelled, causing native resources to be freed while th...

Linux Distros Unpatched Vulnerability : CVE-2026-84962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized...

DEBIAN-CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

UBUNTU-CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84962

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84962 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84962

CVE-2026-84962 is a CRLF injection vulnerability in MongoDB client-side encryption (tracked as MONGOCRYPT-960) affecting GCP key identifier strings . An unauthorized user with key vault write access can forge authenticated Google Cloud KMS API calls under an authorized user's identity by injectin...

EUVD-2026-70516

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

Authenticated KMS request forgery via CRLF injection in GCP key identifier strings

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-84971 Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

PT-2026-85066

Name of the Vulnerable Software and Affected Versions Google Cloud KMS affected versions not specified Description An unauthorized user with key vault write access can trick an authorized client into making arbitrary authenticated Google Cloud KMS API calls using the authorized user's identity...

PT-2026-85074

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the...

CVE-2026-81530

A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...