Read the docs
TI-2021-03616 Aliases CVE-2021-20328GHSA-rghw-6px2-fgwc

MongoDB Java driver client-side field level encryption not verifying KMS host name

Priority LOW 32CWE-295Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Partial org.mongodb:mongodb-driver (Maven): 3.11.3, 3.12.8org.mongodb:mongodb-driver-sync (Maven): 4.0.6, 4.1.2, 4.2.1 +2+2 more productsRed Hat: 3 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBmongo-java-driver3.11 – 3.11.2; 3.12 – 3.12.7—No fix listedCNA
MongoDBmongodb-driver3.11 – 3.11.2; 3.12 – 3.12.7—No fix listedCNA
MongoDBmongodb-driver-sync4.2.0; 3.11 – 3.11.2; 3.12 – 3.12.7; 4.0 – 4.0.5; 4.1 – 4.1.1—No fix listedCNA
MongoDBmongodb-driver-legacy4.2.0; 3.11 – 3.11.2; 3.12 – 3.12.7; 4.0 – 4.0.5; 4.1 – 4.1.1—No fix listedCNA
—org.mongodb:mongodb-driver (Maven)3.11.0 to before 3.11.33.11.3Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver (Maven)3.12.0 to before 3.12.83.12.8Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-sync (Maven)4.0.0 to before 4.0.64.0.6Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-sync (Maven)4.1.0 to before 4.1.24.1.2Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-sync (Maven)4.2.0 to before 4.2.14.2.1Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongo-java-driver (Maven)3.11.0 to before 3.11.33.11.3Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongo-java-driver (Maven)3.12.0 to before 3.12.83.12.8Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-legacy (Maven)4.0.0 to before 4.0.64.0.6Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-legacy (Maven)4.1.0 to before 4.1.24.1.2Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-legacy (Maven)3.11.0 to before 3.11.33.11.3Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-legacy (Maven)3.12.0 to before 3.12.83.12.8Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-sync (Maven)3.12.0 to before 3.12.83.12.8Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-sync (Maven)3.11.0 to before 3.11.33.11.3Patch availableGHSA-rghw-6px2-fgwc
—org.mongodb:mongodb-driver-legacy (Maven)4.2.0 to before 4.2.14.2.1Patch availableGHSA-rghw-6px2-fgwc
  • mongo-java-driver VendorMongoDB Affected 3.11 – 3.11.2; 3.12 – 3.12.7 Fixed in — No fix listed CNA
  • mongodb-driver VendorMongoDB Affected 3.11 – 3.11.2; 3.12 – 3.12.7 Fixed in — No fix listed CNA
  • mongodb-driver-sync VendorMongoDB Affected 4.2.0; 3.11 – 3.11.2; 3.12 – 3.12.7; 4.0 – 4.0.5; 4.1 – 4.1.1 Fixed in — No fix listed CNA
  • mongodb-driver-legacy VendorMongoDB Affected 4.2.0; 3.11 – 3.11.2; 3.12 – 3.12.7; 4.0 – 4.0.5; 4.1 – 4.1.1 Fixed in — No fix listed CNA
  • org.mongodb:mongodb-driver (Maven) Vendor— Affected 3.11.0 to before 3.11.3 Fixed in 3.11.3 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver (Maven) Vendor— Affected 3.12.0 to before 3.12.8 Fixed in 3.12.8 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-sync (Maven) Vendor— Affected 4.0.0 to before 4.0.6 Fixed in 4.0.6 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-sync (Maven) Vendor— Affected 4.1.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-sync (Maven) Vendor— Affected 4.2.0 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongo-java-driver (Maven) Vendor— Affected 3.11.0 to before 3.11.3 Fixed in 3.11.3 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongo-java-driver (Maven) Vendor— Affected 3.12.0 to before 3.12.8 Fixed in 3.12.8 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-legacy (Maven) Vendor— Affected 4.0.0 to before 4.0.6 Fixed in 4.0.6 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-legacy (Maven) Vendor— Affected 4.1.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-legacy (Maven) Vendor— Affected 3.11.0 to before 3.11.3 Fixed in 3.11.3 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-legacy (Maven) Vendor— Affected 3.12.0 to before 3.12.8 Fixed in 3.12.8 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-sync (Maven) Vendor— Affected 3.12.0 to before 3.12.8 Fixed in 3.12.8 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-sync (Maven) Vendor— Affected 3.11.0 to before 3.11.3 Fixed in 3.11.3 Patch available GHSA-rghw-6px2-fgwc
  • org.mongodb:mongodb-driver-legacy (Maven) Vendor— Affected 4.2.0 to before 4.2.1 Fixed in 4.2.1 Patch available GHSA-rghw-6px2-fgwc

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*3.11.0 to before 3.11.3; 3.12.0 to before 3.12.8; 4.0.0 to before 4.0.6; 4.1.0 to before 4.1.2; 4.2.0 to before 4.2.1VulnerableMongoDB
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 1.13.3Vulnerablequarkusio
cpe:2.3:a:quarkus:quarkus:1.13.3:*:*:*:*:*:*:*1.13.3Vulnerablequarkusio
  • cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* Versions 3.11.0 to before 3.11.3; 3.12.0 to before 3.12.8; 4.0.0 to before 4.0.6; 4.1.0 to before 4.1.2; 4.2.0 to before 4.2.1 Vulnerable ·MongoDB
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 1.13.3 Vulnerable ·quarkusio
  • cpe:2.3:a:quarkus:quarkus:1.13.3:*:*:*:*:*:*:* Versions 1.13.3 Vulnerable ·quarkusio

Remediation

  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver (Maven) Fixed in 3.11.3 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver (Maven) Fixed in 3.12.8 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-sync (Maven) Fixed in 4.0.6 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-sync (Maven) Fixed in 4.1.2 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-sync (Maven) Fixed in 4.2.1 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongo-java-driver (Maven) Fixed in 3.11.3 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongo-java-driver (Maven) Fixed in 3.12.8 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-legacy (Maven) Fixed in 4.0.6 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-legacy (Maven) Fixed in 4.1.2 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-legacy (Maven) Fixed in 3.11.3 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-legacy (Maven) Fixed in 3.12.8 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-sync (Maven) Fixed in 3.12.8 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-sync (Maven) Fixed in 3.11.3 Advisory →
  • Fix · GHSA-rghw-6px2-fgwc org.mongodb:mongodb-driver-legacy (Maven) Fixed in 4.2.1 Advisory →

Red Hat 3 advisories

  • RHSA-2021:4918 Released 2021-12-02 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.6 release and security update
    • Red Hat Integration
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2
  • RHSA-2021:0871 Released 2021-03-16 · Red Hat rating Moderate
    Red Hat Integration Debezium 1.4.2 security update
    • Red Hat Integration Debezium 1.4.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat build of Debezium 1AffectedNo fix yet
Red Hat IntegrationFixed RHSA-2021:4918
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat Integration Debezium 1.4.2Fixed RHSA-2021:0871
Not affected: 6 products
  • Red Hat Fuse 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Fuse 6
  • Red Hat OpenShift Container Platform 4
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20328
  2. 2026-10-03 Alias added: GHSA-rghw-6px2-fgwc

References

Patch 1

Advisory 1

  • TI-2026-60057 Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver CVSS 4.0HIGH 8.2
  • TI-2026-15335 Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization CVSS 4.0HIGH 8.2
  • TI-2026-60058 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver CVSS 4.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences