CVE-2026-84971
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.16%
- CWE
- CWE-617
- Published
- 2026-09-03
- Last modified
- 2026-09-03
Affected products
- MongoDB libmongocrypt
Weakness type
Related vulnerabilities
- CVE-2026-75584 — ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion
- CVE-2026-82068 — Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service
- CVE-2026-82065 — Insufficient Validation of Storage Configuration Options in MongoDB Server Leads to Persistent Denial of Service via Corrupted Metadata
- CVE-2026-82064 — Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in Read Concern Processing on Replica Set Members
- CVE-2026-82059 — Improper Access Restriction of Internal Aggregation Expression in MongoDB Server Leads to Assertion Failure and Denial of Service
- CVE-2026-82052 — $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars
- CVE-2026-86317 — ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion
- CVE-2026-20504 — In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote...