Read the docs
TI-2026-58394 Aliases CVE-2026-84971GHSA-pxxc-vwf4-r3mr

Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path

Priority LOW 31CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617.

Summary

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00259 17th percentileScored 2026-11-07
Fix Partial libmongocrypt (MongoDB): 1.20.4Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBlibmongocrypt1.7.0 to before 1.20.41.20.4Patch availableCNA
  • libmongocrypt VendorMongoDB Affected 1.7.0 to before 1.20.4 Fixed in 1.20.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:libmongocrypt:*:*:*:*:*:*:*:*1.7.0 to before 1.20.4VulnerableMongoDB
  • cpe:2.3:a:mongodb:libmongocrypt:*:*:*:*:*:*:*:* Versions 1.7.0 to before 1.20.4 Vulnerable ·MongoDB

Remediation

  • Fix · CNA libmongocrypt (MongoDB) Fixed in 1.20.4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift PipelinesAffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84971
  2. 2026-10-03 Alias added: GHSA-pxxc-vwf4-r3mr

References

Patch 1

  • TI-2026-69711 Memory corruption in MongoDB libmongocrypt with duplicate masterKey CVSS 4.0HIGH 8.7
  • TI-2026-58385 Authenticated KMS request forgery via CRLF injection in GCP key identifier strings CVSS 4.0MEDIUM 5.7
  • TI-2026-56244 Cross-tenant database retargeting via dot/NUL injection in namespace strings in libmongocrypt CVSS 4.0LOW 2.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences