Threat Intelligence Database

CVE-2026-106434 is a medium severity vulnerability in MongoDB libmongocrypt affecting versions from 1.5.0 up to but not including 1.20.5. The issue involves improper validation of the integrity check value during explicit decryption, where unrecognized encrypted payloads may be returned unchanged instead of triggering a decryption error. This flaw could allow an actor capable of modifying stored encrypted fields to cause the application to treat manipulated ciphertext as decrypted plaintext.

CVE-2026-106433 is a high-severity vulnerability in MongoDB's libmongocrypt library involving improper state management that leads to type confusion. This flaw occurs when cleaning up a key document containing duplicate masterKey fields, causing provider-specific data to be treated as an incompatible type. An authenticated actor able to modify key vault documents or a server returning such a key document can trigger invalid memory access and invalid frees in the client process, potentially terminating the application or corrupting memory.

CVE-2026-106429 is an integer underflow vulnerability in the KMS endpoint-parsing logic of MongoDB libmongocrypt. It can cause an allocation failure that terminates the application process. This occurs when an authenticated user modifies a key document in the key vault collection or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The vulnerability does not result in memory access outside allocated bounds.