CVE-2026-88032: CWE-416: Use After Free in MongoDB Java Driver
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-88032) involves a use-after-free condition in the reactive client-side encryption feature of the MongoDB Java Driver versions 4.2.0 up to but not including 5.11.1. When an affected encrypted operation is cancelled, native resources may be freed prematurely while still in use, leading to potential application process termination. The issue requires a specific configuration where KMS credentials are retrieved on demand during reactive encryption operations.
Potential Impact
An attacker capable of causing cancellation of an affected encrypted operation can trigger a use-after-free condition that may crash the hosting application process. This results in denial of service due to process termination. There is no indication of code execution or data leakage from the provided information.
Mitigation Recommendations
No official patch or fix information is provided in the vendor advisory. Patch status is not yet confirmed — check the MongoDB vendor advisory for current remediation guidance. Until a fix is available, avoid using the reactive client-side encryption configuration that retrieves KMS credentials on demand or implement application-level safeguards to handle operation cancellations safely.
CVE-2026-88032: CWE-416: Use After Free in MongoDB Java Driver
Description
A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.
CVSS v4.0
Score 8.2high
Affected software
MongoDB
Java Driver
pkg:maven/org.mongodb/mongodb-driverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-88032) involves a use-after-free condition in the reactive client-side encryption feature of the MongoDB Java Driver versions 4.2.0 up to but not including 5.11.1. When an affected encrypted operation is cancelled, native resources may be freed prematurely while still in use, leading to potential application process termination. The issue requires a specific configuration where KMS credentials are retrieved on demand during reactive encryption operations.
Potential Impact
An attacker capable of causing cancellation of an affected encrypted operation can trigger a use-after-free condition that may crash the hosting application process. This results in denial of service due to process termination. There is no indication of code execution or data leakage from the provided information.
Mitigation Recommendations
No official patch or fix information is provided in the vendor advisory. Patch status is not yet confirmed — check the MongoDB vendor advisory for current remediation guidance. Until a fix is available, avoid using the reactive client-side encryption configuration that retrieves KMS credentials on demand or implement application-level safeguards to handle operation cancellations safely.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mongodb
- Date Reserved
- 2026-09-09T19:49:39.184Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa2f93ef625eac0738ac38d
Added to database: 09/10/2026, 18:38:54 UTC
Last enriched: 09/10/2026, 18:44:37 UTC
Last updated: 09/10/2026, 19:16:50 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.