Read the docs
TI-2026-60057 Aliases CVE-2026-88032GHSA-38pq-38pp-9f4m

Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver

Priority LOW 35CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Partial Java Driver (MongoDB): 5.11.1org.mongodb:mongodb-crypt Maven package (MongoDB): 5.11.1+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MongoDBJava Driver4.2.0 to before 5.11.15.11.1Patch availableCNA
MongoDBorg.mongodb:mongodb-crypt Maven package1.4.0 to before 5.11.15.11.1Patch availableCNA
MongoDBorg.mongodb:mongodb-driver-reactivestreams Maven package4.6.0 to before 5.11.15.11.1Patch availableCNA
  • Java Driver VendorMongoDB Affected 4.2.0 to before 5.11.1 Fixed in 5.11.1 Patch available CNA
  • org.mongodb:mongodb-crypt Maven package VendorMongoDB Affected 1.4.0 to before 5.11.1 Fixed in 5.11.1 Patch available CNA
  • org.mongodb:mongodb-driver-reactivestreams Maven package VendorMongoDB Affected 4.6.0 to before 5.11.1 Fixed in 5.11.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:*4.2.0 to before 5.11.1VulnerableMongoDB
  • cpe:2.3:a:mongodb:java_driver:*:*:*:*:*:mongodb:*:* Versions 4.2.0 to before 5.11.1 Vulnerable ·MongoDB

Remediation

  • Fix · CNA Java Driver (MongoDB) Fixed in 5.11.1
  • Fix · CNA org.mongodb:mongodb-crypt Maven package (MongoDB) Fixed in 5.11.1
  • Fix · CNA org.mongodb:mongodb-driver-reactivestreams Maven package (MongoDB) Fixed in 5.11.1

Red Hat 2 advisories

  • RHSA-2026:83520 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.4 release and security update
    • Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
  • RHSA-2026:83082 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.6 release and security update
    • Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    MongoDB Java Driver 5.11.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-60058 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java DriverPriority LOW 28
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet: Fix deferred
Red Hat build of Quarkus 3.27.6.redhatFixed RHSA-2026:83082
Red Hat build of Quarkus 3.33.4.redhatFixed RHSA-2026:83520
Not affected: 3 products
  • Red Hat Fuse 7
  • Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat build of Quarkus 3.33.4.redhat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-88032
  2. 2026-10-03 Alias added: GHSA-38pq-38pp-9f4m
  3. 2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
  4. 2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
  5. 2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat

References

Advisory 1

  • TI-2026-15335 Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization CVSS 4.0HIGH 8.2
  • TI-2021-03616 MongoDB Java driver client-side field level encryption not verifying KMS host name CVSS 3.1MEDIUM 6.8
  • TI-2026-60058 GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver CVSS 4.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences