MongoDB CSFLE Improper Value Size Handling Terminates Process
CVE-2026-84971 Published on September 3, 2026
Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to control the responses the application receives, may cause that application to stop running.
Vulnerability Analysis
CVE-2026-84971 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an assertion failure Vulnerability?
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVE-2026-84971 has been classified to as an assertion failure vulnerability or weakness.
Affected Versions
MongoDB libmongocrypt:- Version 1.7.0 and below 1.20.4 is affected.