An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application… (CVE-2026-106429)

CVE-2026-106429 describes an integer underflow in the key management service (KMS) endpoint-parsing logic within MongoDB's libmongocrypt library. This flaw can trigger an allocation failure leading to application termination (denial of service). The issue arises when an authenticated user modifies key vault documents or when the application processes a KMS endpoint URL containing a colon character after its path or query component during key creation. Importantly, the vulnerability does not cause out-of-bounds memory access, limiting its impact to denial of service rather than data corruption or escalation.

The vulnerability can cause the libmongocrypt application to terminate unexpectedly, resulting in denial of service. There is no impact on confidentiality or integrity, as the flaw does not allow memory corruption or unauthorized data access. The attack requires authenticated user privileges to modify key vault documents or to supply specially crafted KMS endpoints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to modify key vault collections and validate KMS endpoint inputs to prevent malformed URLs containing colons after path or query components.